Code difference flaw scanner
AssigneeVeracode, Inc.
InventorTaylor Vandervoort Hayward
Life of this patent
Estimating the term…
Abstract
When a code fragment is submitted for merger with a target program code, a software development tool determines the diffs between the code fragment and the target program code. The target program code may be a primary program code (e.g., main branch or trunk) or another branch or fork. The tool scans the diffs for security flaws and can also operate as a linter against the diffs. The tool identifies diffs that introduce security flaws or fail to comply with linter policy/rules in a user interface of the tool and can be programmed to disregard specified flaws to expedite review. Focusing the scanning on diffs avoids overwhelming peer reviewers with the technical debt and allows reviewers to fulfill the commitment to expedited review and the continuous development process.
Claims20
A method comprising:
- determining program code differences that would result from merging a code fragment with a target code unit;
- based on indications of the program code differences, scanning the program code differences to detect flaws that may be introduced into the target code unit if merged with the code fragment;
- for each flaw detected from the scanning, annotating a corresponding one of the program code differences with an indication of the flaw and a description of the flaw;
- and
- updating a graphical user interface of a software development tool to indicate the differences and to indicate the annotations in association with corresponding ones of the differences.
One or more non-transitory machine-readable media comprising program code for code diff scanning, the program code comprising instructions to:
- determine program code differences that would result from merging a code fragment with a target code unit;
- based on indications of the program code differences, scan the program code differences to detect flaws that may be introduced into the target code unit if merged with the code fragment;
- for each flaw detected from the scanning, annotate a corresponding one of the program code differences with an indication of the flaw and a description of the flaw;
- and
- update a graphical user interface of a software development tool to indicate the differences and to indicate the annotations in association with corresponding ones of the differences.
An apparatus comprising:
- a processor;
- and
- a machine-readable medium having program code executable by the processor to cause the apparatus to,
- determine program code differences that would result from merging a code fragment with a target code unit;
- based on indications of the program code differences, scan the program code differences to detect flaws that may be introduced into the target code unit if merged with the code fragment;
- for each flaw detected from the scanning, annotate a corresponding one of the program code differences with an indication of the flaw and a description of the flaw;
- and
- update a graphical user interface of a software development tool to indicate the differences and to indicate the annotations in association with corresponding ones of the differences.
Dependencies are inferred from the claim text.