blocks|key|3852879|text|有各种各样的好处：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3852880|3852881|如果你的代码中有反模式，你可以得到警告。|ordered-list-item|3852882|有一些特定的度量标准(比如麦凯布的圈复杂度)可以告诉你关于源代码的有用信息。|3852883|你也可以从静态分析中得到像调用图和类图这样的好东西。如果你正在开发一个新的代码库，这些都是很棒的。|3852884|3852885|看一看SourceMonitor|offset|length|3852886|entityMap|0|LINK|mutability|MUTABLE|url|http://www.campwoodsw.com/sourcemonitor.html^0|0|0|0|0|0|0|3|D|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|X|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|Y|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|Z|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|10|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|11|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|12|8|@]|9|@$M|13|N|14|1|15]]|A|$]]|$1|O|3|-4|5|6|7|16|8|@]|9|@]|A|$]]]|P|$Q|$5|R|S|T|A|$U|V]]]]

<p>There are all kinds of benefits:</p>

<ol>
<li>If there are anti-patterns in your code, you can be warned about it.</li>
<li>There are certain metrics (such as McCabe's Cyclomatic Complexity)
that tell useful things about source code.</li>
<li>You can also get great stuff like call-graphs, and class diagrams
from static analysis.  Those are wonderful if you are attacking a
new code base.</li>
</ol>

<p>Take a look at <a href="http://www.campwoodsw.com/sourcemonitor.html" rel="noreferrer">SourceMonitor</a></p>


blocks|key|3852766|text|许多类别的内存泄漏和常见的逻辑错误也可以静态捕获。您还可以查看圈复杂度等，这可能是您提到的“编码标准”的一部分，但也可能是用于评估代码的算法“整洁性”的单独度量。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3852767|在任何情况下，只有分析(动态或运行时分析)和静态分析/linting的明智组合才能确保一致、可靠的代码库。哦，那个，还有一点运气;-)|3852768|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

<p>Many classes of memory leaks and common logic errors can be caught statically as well.  You can also look at cyclomatic complexity and such, which may be part of the "coding standards" you mentioned, but may be a separate metric you use to evaluate the algorithmic "cleanliness" of your code.</p>

<p>In any case, only a judicious combination of profiling (dynamic or run-time analysis) and static analysis/linting will ensure a consistent, reliable code base.  Oh, that, and a little luck ;-)</p>


blocks|key|5263984|text|这是一种权衡。对于想要提高对框架和指南的理解的个人开发人员，我绝对会鼓励他们这样做。FxCop会产生很多噪音/误报，但我也发现了以下好处：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5263985|5263986|it检测错误(例如，有关未使用的参数的警告可能表明您在方法中使用了错误的参数FxCop正在遵循的指南帮助您成为一名更好的开发人员。|unordered-list-item|5263987|5263988|然而，对于一个混合能力的团队，FxCop很可能会生成太多的假阳性而无用。初级开发人员将很难理解FxCop抛出的一些更深奥的违规是否应该与他们相关，还是仅仅是噪音。|5263989|底线：|5263990|5263991|如果您正在开发可重用的类库，如内部框架，请确保您有优秀的开发人员并使用FxCop。|5263992|对于具有混合能力的团队的日常应用程序开发，它可能不是practicable.|5263993|5263994|entityMap^0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|T|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|U|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|V|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|W|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|X|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|L|3|M|5|E|7|Z|8|@]|9|@]|A|$]]|$1|N|3|O|5|E|7|10|8|@]|9|@]|A|$]]|$1|P|3|-4|5|6|7|11|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|R|$]]

<p>It's a trade-off.  For an individual developer who wants to improve his understanding of the framework and guidelines, I would definitely encourage it.  FxCop generates a lot of noise / false positives, but I've also found the following benefits:</p>

<ul>
<li><p>it detects bugs (e.g. a warning about an unused argument may indicate you used the wrong argument in the method body).</p></li>
<li><p>understanding the guidelines FxCop is following helps you to become a better developer.</p></li>
</ul>

<p>However with a mixed-ability team, FxCop may well generate too many false positives to be useful.  Junior developers will have difficulty appreciating whether some of the more esoteric violations thrown up by FxCop should concern them or are just noise.</p>

<p>Bottom line:</p>

<ul>
<li><p>If you're developing reusable class libraries, such as an in-house framework, make sure you have good developers and use FxCop.</p></li>
<li><p>For everyday application development with mixed-ability teams, it will probably not be practicable.</p></li>
</ul>


blocks|key|760020|text|实际上，fxcop并不能特别帮助您遵循编码标准。它能帮助你的是设计一个深思熟虑的框架/API。确实，编码标准的某些部分(例如公共成员的大小写)将被FxCop捕获，但编码标准并不是重点。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|760021|可以使用stylecop检查编码标准，它检查源代码，而不是像fxcop那样检查MSIL。|offset|length|760022|entityMap|0|LINK|mutability|MUTABLE|url|http://code.msdn.microsoft.com/sourceanalysis^0|0|4|8|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

<p>actually, fxcop doesn't particularly help you follow a coding standard.  What it does help you with is designing a well-thought out framework/API.  It's true that parts of the coding standard (such as casing of public members) will be caught by FxCop, but coding standards isn't the focus.</p>

<p>coding standards can be checked with <a href="http://code.msdn.microsoft.com/sourceanalysis" rel="nofollow noreferrer">stylecop</a>, which checks the source code instead of the MSIL like fxcop does.</p>


blocks|key|3008328|text|它可以捕获实际的bug，比如忘记处理IDisposables。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3008329|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

<p>It can catch actual bugs, like forgetting to Dispose IDisposables.</p>


blocks|key|3008408|text|依赖于规则，但可以避免许多细微的缺陷，可以清理代码，可以检测到潜在的性能问题等。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3008409|把它放在一个way...if它便宜或免费(在时间和财务成本方面)，而且不会破坏任何东西，为什么不使用它呢？|3008410|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

<p>Depends on the rules, but many subtle defects can be avoided, code can be cleaned, potential performance problems can be detected etc.  </p>

<p>Put it one way...if it's cheap or free (in both time and financial costs) and doesn't break anything, why not use it?</p>


blocks|key|760280|text|FxCop|type|unstyled|depth|inlineStyleRanges|entityRanges|data|760281|这里有一个all+warnings+in+FxCop的列表。您可以看到以下几个方面的警告：|offset|length|760282|760283|设计警告|blockquote|760284|760285|支持.NET框架设计指南所指定的正确的库设计的警告。|760286|全球化警告|760287|支持世界范围内的库和应用程序的警告。|760288|互操作性警告|760289|支持与COM客户端交互的警告。|760290|命名警告|760291|支持遵守.NET框架设计指南的命名约定的警告。|760292|性能警告|760293|支持高性能库和应用程序的警告。|760294|安全警告|760295|支持更安全的库和应用程序的警告。|760296|760297|根据您的应用程序，这些领域中的一些可能不是很有趣，但如果您需要COM互操作性，测试可以真正帮助您避免陷阱。|760298|其他工具|760299|其他静态检查工具可以帮助您检测not+disposing+an+IDisposable、内存泄漏和其他细微的错误。有关极端情况，请参阅尚未发布的NStatic工具。|760300|760301|+NStatic用于跟踪冗余参数、计算为常量的表达式、无限循环和许多其他指标。|760302|760303|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/bb429379(VS.80).aspx)|1|https://stackoverflow.com/questions/104196/benefits-of-static-code-analysis#104226|2|http://codebetter.com/blogs/raymond.lewallen/archive/2007/03/18/Another-big-splash-in-Redmond-_2D00_-NStatic.aspx^0|0|5|L|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|F|S|1|20|7|2|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1U|8|@]|9|@$D|1V|E|1W|1|1X]]|A|$]]|$1|F|3|-4|5|6|7|1Y|8|@]|9|@]|A|$]]|$1|G|3|H|5|I|7|1Z|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|20|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|21|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|22|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|23|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|24|8|@]|9|@]|A|$]]|$1|S|3|T|5|6|7|25|8|@]|9|@]|A|$]]|$1|U|3|V|5|6|7|26|8|@]|9|@]|A|$]]|$1|W|3|X|5|6|7|27|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|6|7|28|8|@]|9|@]|A|$]]|$1|10|3|11|5|6|7|29|8|@]|9|@]|A|$]]|$1|12|3|13|5|6|7|2A|8|@]|9|@]|A|$]]|$1|14|3|15|5|6|7|2B|8|@]|9|@]|A|$]]|$1|16|3|-4|5|6|7|2C|8|@]|9|@]|A|$]]|$1|17|3|18|5|6|7|2D|8|@]|9|@]|A|$]]|$1|19|3|1A|5|6|7|2E|8|@]|9|@]|A|$]]|$1|1B|3|1C|5|6|7|2F|8|@]|9|@$D|2G|E|2H|1|2I]|$D|2J|E|2K|1|2L]]|A|$]]|$1|1D|3|-4|5|6|7|2M|8|@]|9|@]|A|$]]|$1|1E|3|1F|5|I|7|2N|8|@]|9|@]|A|$]]|$1|1G|3|-4|5|6|7|2O|8|@]|9|@]|A|$]]|$1|1H|3|-4|5|6|7|2P|8|@]|9|@]|A|$]]]|1I|$1J|$5|1K|1L|1M|A|$1N|1O]]|1P|$5|1K|1L|1M|A|$1N|1Q]]|1R|$5|1K|1L|1M|A|$1N|1S]]]]

<h1>FxCop</h1>
<p>There is a list of <a href="http://msdn.microsoft.com/en-us/library/bb429379(VS.80).aspx" rel="nofollow noreferrer">all warnings in FxCop</a>. You can see that there are warnings from the following areas:</p>
<blockquote>
<h2>Design Warnings</h2>
<p>Warnings that support proper library
design as specified by the .NET
Framework Design Guidelines.</p>
<h2>Globalization Warnings</h2>
<p>Warnings that support world-ready
libraries and applications.</p>
<h2>Interoperability Warnings</h2>
<p>Warnings that support interacting with
COM clients.</p>
<h2>Naming Warnings</h2>
<p>Warnings that support adherence to the
naming conventions of the .NET
Framework Design Guidelines.</p>
<h2>Performance Warnings</h2>
<p>Warnings that support high performance
libraries and applications.</p>
<h2>Security Warnings</h2>
<p>Warnings that support safer libraries
and applications.</p>
</blockquote>
<p>Depending on your application some of those areas might not be very interesting, but if you e.g. need COM interoperability, the tests can really help you to avoid the pitfalls.</p>
<h1>Other tools</h1>
<p>Other static checking tools can help you to detect bugs like <a href="https://stackoverflow.com/questions/104196/benefits-of-static-code-analysis#104226">not disposing an IDisposable</a>, memory leaks and other subtle bugs. For a extreme case see the not-yet-released <a href="http://codebetter.com/blogs/raymond.lewallen/archive/2007/03/18/Another-big-splash-in-Redmond-_2D00_-NStatic.aspx" rel="nofollow noreferrer">NStatic</a> tool.</p>
<blockquote>
<p>NStatic is used to track things such as redundant parameters, expressions that evaluate to constants, infinite loops and many other metrics.</p>
</blockquote>


blocks|key|3853077|text|这样做的好处是您可以在软件应用程序中自动执行find+and+quantify+technical+debt。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3853078|我发现静态代码分析工具在大型企业应用程序开发中是不可或缺的，在这种情况下，许多开发人员和测试人员在应用程序的生命周期中来来往往，但仍然需要保持较高的代码质量，并适当管理技术债务。|3853079|entityMap|0|LINK|mutability|MUTABLE|url|http://andrewmatthewthompson.blogspot.com/2011/05/technical-debt.html^0|M|W|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

<p>The benefits are that you can automatically <a href="http://andrewmatthewthompson.blogspot.com/2011/05/technical-debt.html" rel="nofollow">find and quantify technical debt</a> within your software application. </p>

<p>I find static code analysis tools indispensable on large enterprise application development where many developers and testers come and go over the life of an application but the code quality still needs to be kept high and the technical debt managed properly.</p>


blocks|key|3008735|text|对源代码进行静态代码分析有什么好处？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3008736|好处取决于执行的静态代码分析的类型。静态代码分析可以是简单的，也可以是复杂的。例如，生成关于源代码的度量来识别容易出错的代码就是一种技术。其他技术会主动尝试找出代码中的bug。复杂的技术使用正式的方法来证明您的代码没有bug。|3008737|因此，好处取决于所使用的静态代码分析的类型。如果该技术产生指标(如代码复杂度等)，那么一个好处是这些指标可以在代码审查期间用来识别容易出错的代码。如果该技术检测到错误，那么好处是开发人员可以在单元测试之前识别错误。如果使用基于正式方法的技术来证明代码不包含错误，则好处是可以使用此信息向QA部门(或证书颁发机构)证明代码没有特定类型的错误。|3008738|有关这些技术和优点的更详细说明，也可以在此页面上找到：www.mathworks.com/static-analysis|offset|length|3008739|entityMap|0|LINK|mutability|MUTABLE|url|http://www.mathworks.com/static-analysis^0|0|0|0|R|X|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@$H|V|I|W|1|X]]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

<p><em>What are the benefits of doing static code analysis on your source code?</em></p>

<p>The benefits depend on the type of static code analysis that is performed.  Static code analysis can range from simple to sophisticated techniques.  For example, generating metrics about your source code to identify error prone code is one technique.  Other techniques actively attempt to find bugs in your code. Sophisticated techniques use formal methods to prove that your code is free of bugs.</p>

<p>Therefore the benefit depends on the type of static code analysis being used.  If the technique produces metrics (such as code complexity etc.), then a benefit is that these metrics could be used during code review to identify error prone code.  If the technique detects bugs, then the benefit is that the developer can identify bugs before unit test.  If formal methods based techniques are used to prove that the code does not contain bugs, then the benefit is that this information could be used to prove to the QA department (or certification authorities) that the code is free of certain types of bugs.</p>

<p>A more detailed description of the techniques and benefits can also be found on this page: <a href="http://www.mathworks.com/static-analysis" rel="nofollow">www.mathworks.com/static-analysis</a> </p>


blocks|key|5264292|text|我将试着描述主要的几个：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5264293|5264294|静态代码分析可以在早期阶段识别程序中的检测，从而降低修复它们的成本。|unordered-list-item|5264295|它可以检测动态测试中看不到的程序输入和输出中的缺陷。|5264296|它自动扫描未编译的代码并识别checkmarx我从与checkmarx打交道中了解到的是，静态代码分析可以在单个点修复多个漏洞，这为开发人员节省了大量时间。|5264297|5264298|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|N|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|O|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|P|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|Q|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|L|$]]

<p>I'll try to describe the main ones:</p>

<ul>
<li>Static code analysis identifies detects in the program at early stage, resulting decrease in cost to fix them.</li>
<li>It can detect flaws in the program's inputs and outputs that cannot be seen through dynamic testing.</li>
<li>It automatically scans uncompiled codes and identifies vulnerabilities.</li>
<li>Of what I know from dealing with checkmarx is that static code analysis fixes multiple vulnerabilities at a single point, which saves a lot of time for the developer.</li>
</ul>


<p>What are the benefits of doing static code analysis on your source code? I was playing around with FxCop and I was wondering if there any benefits beyond making sure you are following the coding standards. </p>


Benefits of static code analysis

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

对源代码进行静态代码分析有什么好处？我在使用FxCop，我想知道除了确保您遵循编码标准之外，还有没有什么好处。

问静态代码分析的好处
EN

回答 10

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问静态代码分析的好处EN

回答 10

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问静态代码分析的好处
EN