How should static analysis handle code that interacts with modified external environments?

Rules and Languages Report False-positive / False-negative...
1

Hi everyone,

I’ve been spending more time working with static analysis tools lately and really appreciate how platforms like Sonar help catch bugs and enforce clean coding standards. But I’ve run into a bit of a gray area that I’m hoping to get some perspective on.

In certain projects, code may end up interacting with external environments that aren’t exactly “standard” or officially supported. For example, I’ve come across discussions where developers reference setups similar to roblox modified environments, where the runtime behavior can differ from what the original platform intends.

What I’m trying to understand is how tools like Sonar should ideally treat this kind of interaction. If the code itself is clean and doesn’t violate any syntax or security rules on its own, but it’s designed to run in a modified or non-standard environment, should that raise concerns during analysis? Or is it outside the scope of what static analysis is meant to evaluate?

It also makes me wonder how far static analysis should go in identifying risks tied to external dependencies or environments. For instance, should there be rules or custom checks that flag integrations with systems that might introduce instability or undefined behavior, even if the code passes all traditional quality gates?

I’m not looking to bypass best practices here, just trying to better understand where responsibility lies between writing clean code and ensuring it runs in a safe and compliant environment. Would love to hear how others approach this or if anyone has dealt with similar scenarios.

2

Hi,

Welcome to the community!

I’m going to give my opinion here, but hopefully I will not be the last to do so. First, I think there are 2 questions: what static analysis can detect, and what it should detect.

The Sonar way profiles are (generally) tuned to detect incorrect usage of the language: null pointer dereference, incorrect array access & so on. Static analysis can “easily” detect that stuff.

Then there’s the question of usage within a particular environment, and we have plenty of those rules too. For example, rules about proper use of Spring in Java. That’s not basic language stuff, that’s about acting correctly in your environment. And in that framing, it makes sense to me that you could, and perhaps should, have rules about correct behavior in e.g. the Roblox environment. At that point it becomes “just” a question of writing the rules.

If SonarSource were to write those rules* I wouldn’t expect them to be on by default, since coding for the Roblox environment isn’t our stereotypical use case. It would be up to you to create a custom quality profile that included them. But yes, anything that can be detected statically is fair game IMO.

 
HTH,
Ann

*For the record, you shouldn’t hold your breath for this. We would need to see a broad demand before we embarked on rules for such a specialized environment. However, we do support custom rules for several languages.