CTAL-TTA Static and Dynamic Analysis: Code Quality and Runtime Testing

def process_data(data):
    if data is None:
        return None
    result = transform(data)
    return result
    print("Done")  # Unreachable code detected!

def calculate_total(items):
    total = 0
    for item in items:
        subtotal = item.price * item.quantity
        # Bug: total never updated!
    return total  # Always returns 0

// Style violation: Class name should be PascalCase
public class myClass {  // Should be: MyClass
 
    // Violation: Magic number
    public static final int TIMEOUT = 30;  // OK
    int delay = 30;  // Violation: use constant
}

def get_user_age(user_id):
    user = database.fetch_user(user_id)
    return user.age  # Static analysis: looks fine
                     # Runtime: user could be None!

// Rule: no-unused-vars
const unusedVariable = 5;  // Warning!
 
// Rule: eqeqeq (require strict equality)
if (value == null) { }  // Use === instead
 
// Rule: no-var
var oldStyle = true;  // Use let or const

# SQL Injection vulnerability
def get_user(user_input):
    query = "SELECT * FROM users WHERE id = " + user_input  # DANGER!
    # Should use: query = "SELECT * FROM users WHERE id = %s", (user_input,)
 
# Path Traversal vulnerability
def read_file(filename):
    with open("/data/" + filename) as f:  # DANGER!
        return f.read()
    # Attack: filename = "../../../etc/passwd"
 
# Hardcoded credentials
password = "admin123"  # DANGER: Hardcoded secret!

V(G) = Number of decision points + 1

V(G) = E - N + 2P

Where:
E = Edges (flow connections)
N = Nodes (statements)
P = Connected components (usually 1)

def process_order(order):          # Node 1
    if order.total > 1000:          # Decision 1
        if order.is_member:         # Decision 2
            apply_premium_discount()
        else:
            apply_standard_discount()
    elif order.total > 500:         # Decision 3 (elif counts)
        apply_small_discount()
 
    if order.expedited:             # Decision 4
        add_expedited_shipping()
 
    return finalize_order()         # Node N

# Review: Is the boundary condition correct?
def is_valid_age(age):
    return age >= 0 and age <= 120  # Should 120 be included?
                                     # What about age exactly 0?

# Review: Are all failure modes handled?
def fetch_user_data(user_id):
    try:
        response = api.get_user(user_id)
        return response.json()
    except RequestException:
        return None  # Is None appropriate? Log the error?
                     # What about timeout vs connection error?

# Review: Are resources properly released?
def process_file(path):
    f = open(path)  # File handle leak if exception occurs
    data = f.read()
    f.close()
    return process(data)
 
# Better:
def process_file(path):
    with open(path) as f:  # Guaranteed cleanup
        return process(f.read())

[ ] Input validation present for all external data
[ ] SQL queries use parameterized statements
[ ] No hardcoded credentials or secrets
[ ] Sensitive data encrypted in transit and at rest
[ ] Authentication checks on all protected endpoints
[ ] Authorization verified before sensitive operations
[ ] Error messages don't expose internal details
[ ] Logging doesn't include sensitive data

[ ] N+1 query patterns avoided
[ ] Appropriate caching implemented
[ ] Large collections processed in batches
[ ] Database indexes used for frequent queries
[ ] Expensive operations happen asynchronously
[ ] Connection pooling configured
[ ] Memory allocation optimized for hot paths

# Manual instrumentation example
def original_function(x):
    return x * 2
 
def instrumented_function(x):
    start_time = time.time()
    call_count[function_name] += 1
    result = x * 2
    execution_time = time.time() - start_time
    log_metrics(function_name, execution_time)
    return result

void process_requests() {
    while (running) {
        Request* req = malloc(sizeof(Request));
        handle_request(req);
        // Missing: free(req);  <- Memory leak!
    }
}

char* create_message() {
    char* msg = malloc(100);
    strcpy(msg, "Hello");
    free(msg);
    return msg;  // DANGER: returning freed memory!
}

void copy_name(char* input) {
    char buffer[10];
    strcpy(buffer, input);  // DANGER: no bounds checking!
    // If input > 10 chars, overflows buffer
}

==12345== HEAP SUMMARY:
==12345==     in use at exit: 1,024 bytes in 4 blocks
==12345==   total heap usage: 100 allocs, 96 frees
==12345==
==12345== 1,024 bytes in 4 blocks are definitely lost
==12345==    at 0x4C2FB0F: malloc
==12345==    by 0x401234: process_request (server.c:45)
==12345==    by 0x401456: main (server.c:78)

// Memory leak via static collection
public class Cache {
    private static Map<String, Object> cache = new HashMap<>();
 
    public void addToCache(String key, Object value) {
        cache.put(key, value);  // Never removed = memory leak!
    }
}
 
// Memory leak via unclosed resources
public void readFile(String path) throws IOException {
    FileInputStream fis = new FileInputStream(path);
    // Processing...
    // Missing fis.close() = resource leak
}

Function                  Self Time   Total Time   Calls
--------------------------------------------------------
main()                       0.1%       100.0%        1
  process_orders()           0.5%        85.0%        1
    validate_order()         2.0%        30.0%    10000
      check_inventory()     25.0%        25.0%    10000  <- HOTSPOT!
    calculate_total()        5.0%        50.0%    10000
      apply_discount()      40.0%        40.0%    10000  <- HOTSPOT!

"Worker-1" BLOCKED on lock owned by "Worker-2"
  at com.example.Service.processA()
  waiting to lock <0x12345678> (a java.lang.Object)
  which is held by "Worker-2"

"Worker-2" BLOCKED on lock owned by "Worker-1"
  at com.example.Service.processB()
  waiting to lock <0x87654321> (a java.lang.Object)
  which is held by "Worker-1"

# Example GitHub Actions workflow
name: Code Quality
 
on: [push, pull_request]
 
jobs:
  static-analysis:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
 
      - name: Run ESLint
        run: npx eslint src/ --format json > eslint-report.json
 
      - name: Run SonarQube Analysis
        uses: sonarsource/sonarqube-scan-action@master
        with:
          args: >
            -Dsonar.qualitygate.wait=true
 
      - name: Check Security
        run: npx snyk test --severity-threshold=high

# Strategy 1: Inline suppression (use sparingly)
def legacy_function():
    # noqa: C901 - Complex but well-tested legacy code
    ...
 
# Strategy 2: Configuration-based exclusion
# .eslintrc.json
{
  "rules": {
    "no-console": "off"  // Allow in dev environment
  }
}
 
# Strategy 3: Baseline approach
# Compare against known state, only flag new issues