Slang kotlin more insights

kotlin
scanner
slang

(Josef Procházka) #1

Hello SonarQube ,

Because we need a support for kotlin language I come accros slang and kotlin-plugin projects. It looks very interesing but I am missing more documentation and some future plans for slang and kotlin.
If I am not wrong, this plugin uses own slang parser (which is not language dependent ) + imports reports from detekt.
I wonder if slang AST tree is suitable to detect language dependent issues such as SQL injection or it is meant mostly for “language independent issuses”.

Thank you

Josef Prochazka


(Jonathan Cornaz) #2

Same for me. I’m keen to write rules for Kotlin, but the lack of documentation makes it very hard.


(Alban Auzeill) #3

Hi Josef & Jonathan,

(glossary: AST, abstract syntax tree)

This is how sonar-kotlin-plugin works to analyse one Kotlin file:
Step 1) Read the input file
Step 2) Parse the file using Jetbrains kotlin-compiler to produce an AST with org.jetbrains.kotlin.psi.* nodes
Step 3) Convert kotlin AST to slang AST with org.sonarsource.slang.api.* nodes
Step 4) Apply the slang rules and metrics on the slang AST

Some clarifications:

  • Rules at “Step 4”, focus only on “language independent issues”
  • There’s no entry point after “Step 2” to apply rules on kotlin AST. It would be a nice place to write “language dependent rules”, but it’s not yet possible.
  • I agree about the lack of documentation, we are at the very beginning of the “slang” adventure and we will for sure improve it.

Cheers,

Alban


(Jonathan Cornaz) #4

Thanks for your reply @alban.auzeill.

Is there documentation about how to create slang rules already?

There’s a bunch of rules that I’m sure I could write for Kotlin even on a “language independent” level.


(Alban Auzeill) #5

Jonathan, currently there’s no documentation about how to create slang rules.
Meanwhile, it would be great if you can contribute by starting to describe your rules here: suggestions/rules.


(Jonathan Cornaz) #6

Ok, thanks @alban.auzeill

I did propose 3 rules which are very important for our team and I also reported one false-positive about Kotlin.

I’m eager to read more documentation about how creating slang rules :wink: