opensearch-project / security
Source Code Overview

Analysis scope, overview of main, test, generated, deployment, build, and other code.

Source Code Analysis Scope
Files includes and excluded from analyses
txt
properties
cfg
policy
  • 13 extensions are included in analyses: java, yml, json, md, txt, bat, sh, xml, properties, cfg, gitignore, gradle, policy
  • 7 criteria are used to exclude files from analysis:
    • exclude files with path like ".*/[.][a-zA-Z0-9_]+.*" (Hidden files and folders) (10 files).
    • exclude files with path like ".*/gradle/wrapper/.*" (Gradle) (1 file).
    • exclude files with path like ".*/cache/.*" (Caches) (10 files).
    • exclude files with path like ".*/git[-]history[.]txt" (Git history) (1 file).
    • exclude files with path like ".*/git[-][a-zA-Z0-9_]+[.]txt" (Git data exports for sokrates analyses) (0 files).
    • exclude files with path like ".*[.]txt" (Text files) (5 files).
    • exclude files with path like ".*/sokrates_conventions[.]json" (Sokrates scoping conventions) (1 file).
Overview of Analyzed Files
Basic stats on analyzed files
Intro
For analysis purposes we separate files in scope into several categories: main, test, generated, deployment and build, and other.

  • The main category contains all manually created source code files that are being used in the production.
  • Files in the main category are used as input for other analyses: logical decomposition, concerns, duplication, file size, unit size, and conditional complexity.
  • Test source code files are used only for testing of the product. These files are normally not deployed to production.
  • Build and deployment source code files are used to configure or support build and deployment process.
  • Generated source code files are automatically generated files that have not been manually changed after generation.
  • While a source code folder may contain a number of files, we are primarily interested in the source code files that are being written and maintained by developers.
  • Files containing binaries, documentation, or third-party libraries, for instance, are excluded from analysis. The exception are third-party libraries that have been changed by developers.

main35370 LOC (42%) 286 files
test43636 LOC (52%) 324 files
generated0 LOC (0%) 0 files
build and deployment568 LOC (<1%) 9 files
other3411 LOC (4%) 119 files
Main Code
All manually created or maintained source code that defines logic of the product that is run in a production environment.
policy
Explore:   circles  |  sunburst
  • The following criteria are used to filter files:
    • files with paths like ".*".
  • 286 files match defined criteria (35,370 lines of code, 100.0% vs. main code):
    • 266 *.java files (34,081 lines of code)
    • 19 *.yml files (1,222 lines of code)
    • 1 *.policy files (67 lines of code)
  • " *.java" is biggest, containing 96.36% of code.
  • " *.policy" is smallest, containing 0.19% of code.


*.java34081 LOC (96%) 266 files
*.yml1222 LOC (3%) 19 files
*.policy67 LOC (<1%) 1 files
Test Code
Used only for testing of the product. Normally not deployed in a production environment.
cfg
Explore:   circles  |  sunburst
  • The following criteria are used to filter files:
    • files with paths like ".*/[Tt]est/.*".
    • files with any line of content like ".*/simpletest/.*".
  • 324 files match defined criteria (43,636 lines of code, 123.4% vs. main code):
    • 177 *.java files (28,840 lines of code)
    • 146 *.yml files (14,792 lines of code)
    • 1 *.cfg files (4 lines of code)
  • " *.java" is biggest, containing 66.09% of code.
  • " *.cfg" is smallest, containing 0.01% of code.


*.java28840 LOC (66%) 177 files
*.yml14792 LOC (33%) 146 files
*.cfg4 LOC (<1%) 1 files
Build and Deployment Code
Source code used to configure or support build and deployment process.
Explore:   circles  |  sunburst
  • The following criteria are used to filter files:
    • files with paths like ".*/pom[.]xml".
    • files with paths like ".*[.]sh".
    • files with paths like ".*[.]bat".
    • files with paths like ".*[.]git[a-z]+".
    • files with paths like ".*/[.]gitignore".
    • files with paths like ".*[.]gradle".
  • 9 files match defined criteria (568 lines of code, 1.6% vs. main code):
    • 4 *.sh files (423 lines of code)
    • 4 *.bat files (95 lines of code)
    • 1 *.gradle files (50 lines of code)
  • " *.sh" is biggest, containing 74.47% of code.
  • " *.gradle" is smallest, containing 8.8% of code.


*.sh423 LOC (74%) 4 files
*.bat95 LOC (16%) 4 files
*.gradle50 LOC (8%) 1 files
Other Code
properties
Explore:   circles  |  sunburst
  • The following criteria are used to filter files:
    • files with paths like ".*[.]md".
    • files with paths like ".*[.]properties".
    • files with paths like ".*[.]txt".
    • files with paths like ".*/README[.][a-z0-9]+".
    • files with paths like ".*[.]json".
    • files with paths like ".*/[.]gitignore".
    • files with paths like ".*/LICENSE[.][a-z0-9]+".
    • files with paths like ".*[.](xml|xsd|robot|sql|pgsql|dashboard|profile|ipynb|raml|avsc|al)".
  • 119 files match defined criteria (3,411 lines of code, 9.6% vs. main code):
    • 73 *.json files (1,676 lines of code)
    • 4 *.xml files (1,053 lines of code)
    • 39 *.md files (624 lines of code)
    • 3 *.properties files (58 lines of code)
  • " *.json" is biggest, containing 49.14% of code.
  • " *.properties" is smallest, containing 1.7% of code.


*.json1676 LOC (49%) 73 files
*.xml1053 LOC (30%) 4 files
*.md624 LOC (18%) 39 files
*.properties58 LOC (1%) 3 files
Analyzers
Info about analyzers used for source code examinations.
  • *.java files are analyzed with JavaAnalyzer:
    • All basic standard analyses supported (source code overview, duplication, file size, concerns, findings, metrics, controls)
    • Advanced code cleaning (empty lines and comments removed for LOC calculations, additional cleaning for duplication calculations)
    • Unit size analysis
    • Conditional complexity analysis
    • Advanced heuristic dependency analysis (based on package names)
  • *.yml files are analyzed with YamlAnalyzer:
    • All basic standard analyses supported (source code overview, duplication, file size, concerns, findings, metrics, controls)
    • Advanced code cleaning (empty lines and comments removed for LOC calculations, additional cleaning for duplication calculations)
    • No unit size analysis
    • No conditional complexity analysis
    • No dependency analysis
  • *.policy files are analyzed with DefaultLanguageAnalyzer:
    • All basic standard analyses supported (source code overview, duplication, file size, concerns, findings, metrics, controls)
    • Basic code cleaning (empty lines removed for LOC calculations and duplication calculations)
    • No unit size analysis
    • No conditional complexity analysis
    • No dependency analysis


2022-02-01 04:36