Not sure Programmers Stack Exchange is the place to ask this question, but thought I’d give it a go.
Our team had a near miss recently with a nasty error where a method call had been added to the wrong area of code,such that it deleted the an order immediately after the user had been through the checkout. There was no warning to the customer or us due to the nature of the API we were using (and can’t modify).
It occurred to me that what we wanted was some sort of Audit tool, a bit like a linter, that we could configure to check each new Github commit for use of certain key method calls. If someone made that method call, it would flag it for extra scrutiny.
Maybe a Jenkins plug-in would be the best place for this, as our code runs through Jenkins CI every time we push to our main pre-release branch?
For clarity, this code had been fully tested and code reviewed. While there are lessons to learn in both these areas, this feels like something an automated process could help with.
Ultimately finding the bug was something of good fortune, as one of the developers was tidying something else up in that area of the code.
Some of the questions I have:
- Do such tools exist?
- Where would they typically be best applied; in the IDE, during the source control check in process or in something like Jenkins during CI?
- Are they all programming language specific? Or really,are we limited to simply as running a grep over our code-base?
Any thoughts or ideas really appreciated.
5
For clarity, this code had been fully tested and code reviewed
tested and reviewed, but not fully, obviously. I think that’s the area you should be looking at.
As for a tool – surely a simply regex running over every file in the build is what you want. Alternatively get a open-source static analyis tool and modify it to handle cases where your method is called. These tools will already have checks for other, dangerous methods (eg memcpy in C) so it should be an easy task to modify to handle your own methods.
3