wehub-resource-sync
1021 lines
36 KiB
Python
Executable File
1021 lines
36 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""
|
|
Code Quality Checker
|
|
|
|
Analyzes source code for quality issues, code smells, complexity metrics,
|
|
and SOLID principle violations.
|
|
|
|
Usage:
|
|
python code_quality_checker.py /path/to/file.py
|
|
python code_quality_checker.py /path/to/directory --recursive
|
|
python code_quality_checker.py . --language typescript --json
|
|
"""
|
|
|
|
import argparse
|
|
import json
|
|
import re
|
|
import sys
|
|
from pathlib import Path
|
|
from typing import Dict, List, Optional
|
|
|
|
|
|
# Language-specific file extensions.
|
|
# `c` is declared before `cpp` so plain `.h` resolves to C, matching the
|
|
# dispatch table in SKILL.md. C++ headers use `.hpp` / `.hh` / `.hxx`.
|
|
LANGUAGE_EXTENSIONS = {
|
|
"python": [".py"],
|
|
"typescript": [".ts", ".tsx"],
|
|
"javascript": [".js", ".jsx", ".mjs"],
|
|
"go": [".go"],
|
|
"swift": [".swift"],
|
|
"kotlin": [".kt", ".kts"],
|
|
"csharp": [".cs", ".csx", ".razor", ".cshtml"],
|
|
"java": [".java"],
|
|
"c": [".c", ".h"],
|
|
"cpp": [".cpp", ".cc", ".cxx", ".hpp", ".hh", ".hxx"],
|
|
"rust": [".rs"],
|
|
"ruby": [".rb", ".rake", ".gemspec", ".ru"],
|
|
"php": [".php", ".phtml"],
|
|
"dart": [".dart"],
|
|
}
|
|
|
|
# Code smell thresholds
|
|
THRESHOLDS = {
|
|
"long_function_lines": 50,
|
|
"too_many_parameters": 5,
|
|
"high_complexity": 10,
|
|
"god_class_methods": 20,
|
|
"max_imports": 15
|
|
}
|
|
|
|
|
|
def get_file_extension(filepath: Path) -> str:
|
|
"""Get file extension."""
|
|
return filepath.suffix.lower()
|
|
|
|
|
|
def detect_language(filepath: Path) -> Optional[str]:
|
|
"""Detect programming language from file extension."""
|
|
ext = get_file_extension(filepath)
|
|
for lang, extensions in LANGUAGE_EXTENSIONS.items():
|
|
if ext in extensions:
|
|
return lang
|
|
return None
|
|
|
|
|
|
def read_file_content(filepath: Path) -> str:
|
|
"""Read file content safely."""
|
|
try:
|
|
with open(filepath, "r", encoding="utf-8", errors="ignore") as f:
|
|
return f.read()
|
|
except Exception:
|
|
return ""
|
|
|
|
|
|
def calculate_cyclomatic_complexity(content: str) -> int:
|
|
"""
|
|
Estimate cyclomatic complexity based on control flow keywords.
|
|
"""
|
|
complexity = 1 # Base complexity
|
|
|
|
# Control flow patterns that increase complexity
|
|
patterns = [
|
|
r"\bif\b",
|
|
r"\belif\b",
|
|
r"\belse\b",
|
|
r"\bfor\b",
|
|
r"\bwhile\b",
|
|
r"\bcase\b",
|
|
r"\bcatch\b",
|
|
r"\bexcept\b",
|
|
r"\band\b",
|
|
r"\bor\b",
|
|
r"\|\|",
|
|
r"&&"
|
|
]
|
|
|
|
for pattern in patterns:
|
|
matches = re.findall(pattern, content, re.IGNORECASE)
|
|
complexity += len(matches)
|
|
|
|
return complexity
|
|
|
|
|
|
def count_lines(content: str) -> Dict[str, int]:
|
|
"""Count different types of lines in code."""
|
|
lines = content.split("\n")
|
|
total = len(lines)
|
|
blank = sum(1 for line in lines if not line.strip())
|
|
comment = 0
|
|
|
|
for line in lines:
|
|
stripped = line.strip()
|
|
if stripped.startswith("#") or stripped.startswith("//"):
|
|
comment += 1
|
|
elif stripped.startswith("/*") or stripped.startswith("'''") or stripped.startswith('"""'):
|
|
comment += 1
|
|
|
|
code = total - blank - comment
|
|
|
|
return {
|
|
"total": total,
|
|
"code": code,
|
|
"blank": blank,
|
|
"comment": comment
|
|
}
|
|
|
|
|
|
def find_functions(content: str, language: str) -> List[Dict]:
|
|
"""Find function definitions and their metrics."""
|
|
functions = []
|
|
|
|
# Language-specific function patterns
|
|
patterns = {
|
|
"python": r"def\s+(\w+)\s*\(([^)]*)\)",
|
|
"typescript": r"(?:function\s+(\w+)|(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?\([^)]*\)\s*=>)",
|
|
"javascript": r"(?:function\s+(\w+)|(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?\([^)]*\)\s*=>)",
|
|
"go": r"func\s+(?:\([^)]+\)\s+)?(\w+)\s*\(([^)]*)\)",
|
|
"swift": r"func\s+(\w+)\s*\(([^)]*)\)",
|
|
"kotlin": r"fun\s+(\w+)\s*\(([^)]*)\)",
|
|
# C#: require at least one method modifier (public/private/etc. or static/async/...)
|
|
# to distinguish declarations from invocations.
|
|
"csharp": (
|
|
r"(?:(?:public|private|protected|internal|static|async|virtual|"
|
|
r"override|sealed|abstract|partial|new|readonly|extern)\s+)+"
|
|
r"(?:[\w<>?,\s\[\]\.]+?\s+)?(\w+)\s*\(([^)]*)\)"
|
|
),
|
|
# Java: require at least one method modifier to distinguish
|
|
# declarations from invocations (mirrors the C# approach).
|
|
"java": (
|
|
r"(?:(?:public|private|protected|static|final|abstract|"
|
|
r"synchronized|native|default|strictfp)\s+)+"
|
|
r"(?:[\w<>?,\s\[\]\.]+?\s+)?(\w+)\s*\(([^)]*)\)"
|
|
),
|
|
# C: require an opening brace after the parens so prototypes and
|
|
# call sites don't get matched. Return type / qualifiers come first.
|
|
# Skip C control-flow keywords that look like function calls.
|
|
"c": (
|
|
r"^(?:static\s+|inline\s+|extern\s+|const\s+|unsigned\s+|"
|
|
r"signed\s+|volatile\s+|register\s+)*"
|
|
r"(?:[\w\*]+\s+\**)+"
|
|
r"(?!(?:if|while|for|switch|return|sizeof)\b)"
|
|
r"(\w+)\s*\(([^)]*)\)\s*\{"
|
|
),
|
|
# C++: like C but also catches `ClassName::method(...)` definitions
|
|
# and template return types like `std::vector<int>`.
|
|
"cpp": (
|
|
r"^(?:static\s+|inline\s+|extern\s+|const\s+|virtual\s+|"
|
|
r"explicit\s+|constexpr\s+|noexcept\s+)*"
|
|
r"(?:[\w:\*<>&,\s]+\s+\**)+"
|
|
r"(?!(?:if|while|for|switch|return|sizeof)\b)"
|
|
r"(\w+)(?:::\w+)?\s*\(([^)]*)\)\s*(?:const\s*)?"
|
|
r"(?:noexcept\s*)?(?:override\s*)?(?:final\s*)?\{"
|
|
),
|
|
# Rust: `fn` keyword is always present and unambiguous.
|
|
"rust": (
|
|
r"(?:pub(?:\([^)]+\))?\s+)?(?:async\s+)?(?:unsafe\s+)?"
|
|
r"(?:extern\s+\"[^\"]+\"\s+)?fn\s+(\w+)\s*"
|
|
r"(?:<[^>]+>)?\s*\(([^)]*)\)"
|
|
),
|
|
# Ruby: `def` keyword; params may be parenthesised or bare.
|
|
"ruby": (
|
|
r"def\s+(?:self\.)?(\w+[?!=]?)(?:\s*\(([^)]*)\)|\s*$|\s+\w)"
|
|
),
|
|
# PHP: `function` keyword is always present.
|
|
"php": (
|
|
r"(?:(?:public|private|protected|static|abstract|final)\s+)*"
|
|
r"function\s+(\w+)\s*\(([^)]*)\)"
|
|
),
|
|
# Dart: typed return followed by name and parens. Constructors
|
|
# (where name matches enclosing class) are not specially handled.
|
|
"dart": (
|
|
r"^\s*(?:static\s+|external\s+)*"
|
|
r"(?:Future<[^>]*>|Stream<[^>]*>|void|[\w<>?,\s]+?)\s+"
|
|
r"(\w+)\s*\(([^)]*)\)\s*(?:async\*?\s*|sync\*?\s*)?\{"
|
|
),
|
|
}
|
|
|
|
pattern = patterns.get(language, patterns["python"])
|
|
matches = re.finditer(pattern, content, re.MULTILINE)
|
|
|
|
for match in matches:
|
|
name = next((g for g in match.groups() if g), "anonymous")
|
|
params_str = match.group(2) if len(match.groups()) > 1 and match.group(2) else ""
|
|
|
|
# Count parameters
|
|
params = [p.strip() for p in params_str.split(",") if p.strip()]
|
|
param_count = len(params)
|
|
|
|
# Estimate function length
|
|
start_pos = match.end()
|
|
remaining = content[start_pos:]
|
|
|
|
next_func = re.search(pattern, remaining)
|
|
if next_func:
|
|
func_body = remaining[:next_func.start()]
|
|
else:
|
|
func_body = remaining[:min(2000, len(remaining))]
|
|
|
|
line_count = len(func_body.split("\n"))
|
|
complexity = calculate_cyclomatic_complexity(func_body)
|
|
|
|
functions.append({
|
|
"name": name,
|
|
"parameters": param_count,
|
|
"lines": line_count,
|
|
"complexity": complexity
|
|
})
|
|
|
|
return functions
|
|
|
|
|
|
def find_classes(content: str, language: str) -> List[Dict]:
|
|
"""Find class definitions and their metrics."""
|
|
classes = []
|
|
|
|
patterns = {
|
|
"python": r"class\s+(\w+)",
|
|
"typescript": r"class\s+(\w+)",
|
|
"javascript": r"class\s+(\w+)",
|
|
"go": r"type\s+(\w+)\s+struct",
|
|
"swift": r"class\s+(\w+)",
|
|
"kotlin": r"class\s+(\w+)",
|
|
"csharp": r"(?:class|struct|record|interface)\s+(\w+)",
|
|
"java": r"(?:class|interface|enum|record)\s+(\w+)",
|
|
# C has no classes; `struct` and `typedef struct` are the closest.
|
|
"c": r"(?:typedef\s+)?struct\s+(\w+)",
|
|
"cpp": r"(?:class|struct)\s+(\w+)",
|
|
# Rust uses `struct`, `enum`, `trait`, `union` for type definitions.
|
|
# `impl` blocks attach methods but are not type defs themselves.
|
|
"rust": r"(?:pub(?:\([^)]+\))?\s+)?(?:struct|enum|trait|union)\s+(\w+)",
|
|
"ruby": r"(?:class|module)\s+(\w+)",
|
|
"php": (
|
|
r"(?:abstract\s+|final\s+)?"
|
|
r"(?:class|interface|trait|enum)\s+(\w+)"
|
|
),
|
|
# Dart 3 class modifiers: final / interface / base / sealed / mixin.
|
|
"dart": (
|
|
r"(?:abstract\s+|sealed\s+|final\s+|base\s+|interface\s+)?"
|
|
r"(?:class|mixin|enum|extension)\s+(\w+)"
|
|
),
|
|
}
|
|
|
|
pattern = patterns.get(language, patterns["python"])
|
|
matches = re.finditer(pattern, content)
|
|
|
|
for match in matches:
|
|
name = match.group(1)
|
|
|
|
start_pos = match.end()
|
|
remaining = content[start_pos:]
|
|
|
|
next_class = re.search(pattern, remaining)
|
|
if next_class:
|
|
class_body = remaining[:next_class.start()]
|
|
else:
|
|
class_body = remaining
|
|
|
|
# Count methods
|
|
method_patterns = {
|
|
"python": r"def\s+\w+\s*\(",
|
|
"typescript": r"(?:public|private|protected)?\s*\w+\s*\([^)]*\)\s*[:{]",
|
|
"javascript": r"\w+\s*\([^)]*\)\s*\{",
|
|
"go": r"func\s+\(",
|
|
"swift": r"func\s+\w+",
|
|
"kotlin": r"fun\s+\w+",
|
|
"csharp": (
|
|
r"(?:(?:public|private|protected|internal|static|async|virtual|"
|
|
r"override|sealed|abstract|partial)\s+)+"
|
|
r"(?:[\w<>?,\s\[\]\.]+?\s+)?\w+\s*\("
|
|
),
|
|
"java": (
|
|
r"(?:(?:public|private|protected|static|final|abstract|"
|
|
r"synchronized|native|default|strictfp)\s+)+"
|
|
r"(?:[\w<>?,\s\[\]\.]+?\s+)?\w+\s*\("
|
|
),
|
|
# C has no classes; struct members are typically function pointers
|
|
# rather than methods. Use the function definition pattern.
|
|
"c": (
|
|
r"^(?:static\s+|inline\s+)*(?:[\w\*]+\s+\**)+"
|
|
r"(?!(?:if|while|for|switch|return|sizeof)\b)"
|
|
r"\w+\s*\([^)]*\)\s*\{"
|
|
),
|
|
"cpp": (
|
|
r"^(?:static\s+|inline\s+|virtual\s+|explicit\s+|"
|
|
r"constexpr\s+)*(?:[\w:\*<>&,\s]+\s+\**)+"
|
|
r"(?!(?:if|while|for|switch|return|sizeof)\b)"
|
|
r"\w+(?:::\w+)?\s*\([^)]*\)"
|
|
),
|
|
"rust": (
|
|
r"(?:pub(?:\([^)]+\))?\s+)?(?:async\s+)?(?:unsafe\s+)?"
|
|
r"fn\s+\w+"
|
|
),
|
|
"ruby": r"def\s+(?:self\.)?\w+[?!=]?",
|
|
"php": (
|
|
r"(?:(?:public|private|protected|static|abstract|final)\s+)*"
|
|
r"function\s+\w+\s*\("
|
|
),
|
|
"dart": (
|
|
r"^\s*(?:static\s+|external\s+)*"
|
|
r"(?:Future<[^>]*>|Stream<[^>]*>|void|[\w<>?,\s]+?)\s+"
|
|
r"\w+\s*\([^)]*\)\s*(?:async\*?\s*|sync\*?\s*)?\{"
|
|
),
|
|
}
|
|
method_pattern = method_patterns.get(language, method_patterns["python"])
|
|
methods = len(re.findall(method_pattern, class_body))
|
|
|
|
classes.append({
|
|
"name": name,
|
|
"methods": methods,
|
|
"lines": len(class_body.split("\n"))
|
|
})
|
|
|
|
return classes
|
|
|
|
|
|
def check_code_smells(content: str, functions: List[Dict], classes: List[Dict]) -> List[Dict]:
|
|
"""Check for code smells in the content."""
|
|
smells = []
|
|
|
|
# Long functions
|
|
for func in functions:
|
|
if func["lines"] > THRESHOLDS["long_function_lines"]:
|
|
smells.append({
|
|
"type": "long_function",
|
|
"severity": "medium",
|
|
"message": f"Function '{func['name']}' has {func['lines']} lines (max: {THRESHOLDS['long_function_lines']})",
|
|
"location": func["name"]
|
|
})
|
|
|
|
# Too many parameters
|
|
for func in functions:
|
|
if func["parameters"] > THRESHOLDS["too_many_parameters"]:
|
|
smells.append({
|
|
"type": "too_many_parameters",
|
|
"severity": "low",
|
|
"message": f"Function '{func['name']}' has {func['parameters']} parameters (max: {THRESHOLDS['too_many_parameters']})",
|
|
"location": func["name"]
|
|
})
|
|
|
|
# High complexity
|
|
for func in functions:
|
|
if func["complexity"] > THRESHOLDS["high_complexity"]:
|
|
severity = "high" if func["complexity"] > 20 else "medium"
|
|
smells.append({
|
|
"type": "high_complexity",
|
|
"severity": severity,
|
|
"message": f"Function '{func['name']}' has complexity {func['complexity']} (max: {THRESHOLDS['high_complexity']})",
|
|
"location": func["name"]
|
|
})
|
|
|
|
# God classes
|
|
for cls in classes:
|
|
if cls["methods"] > THRESHOLDS["god_class_methods"]:
|
|
smells.append({
|
|
"type": "god_class",
|
|
"severity": "high",
|
|
"message": f"Class '{cls['name']}' has {cls['methods']} methods (max: {THRESHOLDS['god_class_methods']})",
|
|
"location": cls["name"]
|
|
})
|
|
|
|
# Magic numbers
|
|
magic_pattern = r"\b(?<![.\"\'])\d{3,}\b(?!\.\d)"
|
|
for i, line in enumerate(content.split("\n"), 1):
|
|
if line.strip().startswith(("#", "//", "import", "from")):
|
|
continue
|
|
matches = re.findall(magic_pattern, line)
|
|
for match in matches[:1]: # One per line
|
|
smells.append({
|
|
"type": "magic_number",
|
|
"severity": "low",
|
|
"message": f"Magic number {match} should be a named constant",
|
|
"location": f"line {i}"
|
|
})
|
|
|
|
# Commented code patterns
|
|
commented_code_pattern = r"^\s*[#//]+\s*(if|for|while|def|function|class|const|let|var)\s"
|
|
for i, line in enumerate(content.split("\n"), 1):
|
|
if re.match(commented_code_pattern, line, re.IGNORECASE):
|
|
smells.append({
|
|
"type": "commented_code",
|
|
"severity": "low",
|
|
"message": "Commented-out code should be removed",
|
|
"location": f"line {i}"
|
|
})
|
|
|
|
return smells
|
|
|
|
|
|
def _strip_csharp_comments(content: str) -> str:
|
|
"""Remove // line comments and /* */ block comments so regex detectors
|
|
don't match keywords inside prose."""
|
|
no_block = re.sub(r"/\*.*?\*/", "", content, flags=re.DOTALL)
|
|
no_line = re.sub(r"//[^\n]*", "", no_block)
|
|
return no_line
|
|
|
|
|
|
def check_csharp_specific_smells(content: str) -> List[Dict]:
|
|
"""C# / .NET-specific code smells documented in SKILL.md."""
|
|
smells: List[Dict] = []
|
|
content = _strip_csharp_comments(content)
|
|
|
|
# async void (event handler exception only — caller must justify)
|
|
for match in re.finditer(r"\basync\s+void\s+(\w+)\s*\(", content):
|
|
smells.append({
|
|
"type": "csharp_async_void",
|
|
"severity": "high",
|
|
"message": (
|
|
f"'async void {match.group(1)}' — only safe for event handlers; "
|
|
"prefer 'async Task'"
|
|
),
|
|
"location": match.group(1),
|
|
})
|
|
|
|
# Blocking on async: .Result, .Wait(), .GetAwaiter().GetResult()
|
|
for match in re.finditer(
|
|
r"\.(?:Result\b|Wait\(\)|GetAwaiter\(\)\.GetResult\(\))", content
|
|
):
|
|
smells.append({
|
|
"type": "csharp_blocking_async",
|
|
"severity": "high",
|
|
"message": (
|
|
"Blocking call on async operation ('.Result' / '.Wait()' / "
|
|
"'.GetAwaiter().GetResult()') — can deadlock in ASP.NET contexts"
|
|
),
|
|
"location": f"offset {match.start()}",
|
|
})
|
|
|
|
# Bare catch / catch (Exception) that swallows
|
|
swallow_pattern = re.compile(
|
|
r"catch\s*(?:\(\s*(?:System\.)?Exception(?:\s+\w+)?\s*\))?\s*\{\s*\}"
|
|
)
|
|
for match in swallow_pattern.finditer(content):
|
|
smells.append({
|
|
"type": "csharp_swallowed_exception",
|
|
"severity": "high",
|
|
"message": "Empty catch block swallows exceptions silently",
|
|
"location": f"offset {match.start()}",
|
|
})
|
|
|
|
# IDisposable instantiated but not in `using` — heuristic: `new SomethingClient(`
|
|
# / `new SomethingStream(` / `new SqlConnection(` outside a `using` line.
|
|
disposable_hint = re.compile(
|
|
r"^(?!\s*using\b)\s*(?:var|[\w<>]+)\s+\w+\s*=\s*new\s+"
|
|
r"(\w*(?:Stream|Connection|Reader|Writer|Client|Context|Command))\s*\(",
|
|
re.MULTILINE,
|
|
)
|
|
for match in disposable_hint.finditer(content):
|
|
smells.append({
|
|
"type": "csharp_undisposed_idisposable",
|
|
"severity": "medium",
|
|
"message": (
|
|
f"'{match.group(1)}' looks like IDisposable but is not wrapped in "
|
|
"'using' / 'using var'"
|
|
),
|
|
"location": f"offset {match.start()}",
|
|
})
|
|
|
|
# HttpClient instantiated with `new` inside a method body (socket exhaustion)
|
|
httpclient_inline = re.compile(r"new\s+HttpClient\s*\(\s*\)")
|
|
for match in httpclient_inline.finditer(content):
|
|
smells.append({
|
|
"type": "csharp_new_httpclient",
|
|
"severity": "medium",
|
|
"message": (
|
|
"'new HttpClient()' — prefer IHttpClientFactory or a long-lived "
|
|
"static instance to avoid socket exhaustion"
|
|
),
|
|
"location": f"offset {match.start()}",
|
|
})
|
|
|
|
# Missing await: `Task.Run(` / async method call assigned but never awaited.
|
|
# Heuristic: a statement ending in `Async()` or `Async(...)` followed by `;`
|
|
# with no `await` keyword on the same line.
|
|
for line_no, line in enumerate(content.split("\n"), 1):
|
|
stripped = line.strip()
|
|
if not stripped or stripped.startswith(("//", "/*", "*")):
|
|
continue
|
|
if re.search(r"\b\w+Async\s*\([^)]*\)\s*;\s*$", stripped) and "await " not in stripped:
|
|
# Skip `return ...Async();` (forwarding the Task is legitimate)
|
|
if stripped.startswith("return "):
|
|
continue
|
|
smells.append({
|
|
"type": "csharp_missing_await",
|
|
"severity": "medium",
|
|
"message": "Async method called without 'await' — Task is discarded",
|
|
"location": f"line {line_no}",
|
|
})
|
|
|
|
# Unnecessary `using` directives — heuristic: `using` directive whose
|
|
# namespace tail isn't referenced anywhere else in the file.
|
|
using_directives = re.findall(
|
|
r"^using\s+(?:static\s+)?([A-Z]\w*(?:\.\w+)*)\s*;", content, re.MULTILINE
|
|
)
|
|
body = re.sub(r"^using\s+[^;]+;\s*$", "", content, flags=re.MULTILINE)
|
|
for ns in using_directives:
|
|
tail = ns.split(".")[-1]
|
|
if not re.search(rf"\b{re.escape(tail)}\b", body):
|
|
smells.append({
|
|
"type": "csharp_unused_using",
|
|
"severity": "low",
|
|
"message": f"'using {ns};' appears unused",
|
|
"location": ns,
|
|
})
|
|
|
|
return smells
|
|
|
|
|
|
def check_java_specific_smells(content: str) -> List[Dict]:
|
|
"""Java-specific code smells documented in languages/java.md."""
|
|
smells: List[Dict] = []
|
|
# Java comment syntax matches C#, so the same stripper applies.
|
|
content = _strip_csharp_comments(content)
|
|
|
|
# Empty catch block — swallows the exception silently.
|
|
for match in re.finditer(r"catch\s*\([^)]*\)\s*\{\s*\}", content):
|
|
smells.append({
|
|
"type": "java_empty_catch",
|
|
"severity": "high",
|
|
"message": "Empty catch block swallows exceptions silently",
|
|
"location": f"offset {match.start()}",
|
|
})
|
|
|
|
# printStackTrace() as error handling — use a logger instead.
|
|
for match in re.finditer(r"\.printStackTrace\s*\(\s*\)", content):
|
|
smells.append({
|
|
"type": "java_print_stack_trace",
|
|
"severity": "medium",
|
|
"message": (
|
|
"'printStackTrace()' is not real error handling — log via a "
|
|
"proper logger or rethrow with context"
|
|
),
|
|
"location": f"offset {match.start()}",
|
|
})
|
|
|
|
# InterruptedException caught without restoring the interrupt flag.
|
|
for match in re.finditer(
|
|
r"catch\s*\(\s*InterruptedException\s+(\w+)\s*\)\s*\{(.*?)\}",
|
|
content,
|
|
re.DOTALL,
|
|
):
|
|
if "interrupt()" not in match.group(2):
|
|
smells.append({
|
|
"type": "java_swallowed_interrupt",
|
|
"severity": "high",
|
|
"message": (
|
|
"InterruptedException caught without "
|
|
"'Thread.currentThread().interrupt()' — breaks cooperative "
|
|
"cancellation"
|
|
),
|
|
"location": f"offset {match.start()}",
|
|
})
|
|
|
|
# Closeable resource instantiated outside try-with-resources (leak heuristic).
|
|
resource_hint = re.compile(
|
|
r"^(?!\s*try\b)\s*(?:final\s+)?[\w<>\[\]]+\s+\w+\s*=\s*new\s+"
|
|
r"(\w*(?:InputStream|OutputStream|Reader|Writer|Stream|Connection))\s*\(",
|
|
re.MULTILINE,
|
|
)
|
|
for match in resource_hint.finditer(content):
|
|
smells.append({
|
|
"type": "java_unclosed_resource",
|
|
"severity": "medium",
|
|
"message": (
|
|
f"'{match.group(1)}' looks like an AutoCloseable but is not in a "
|
|
"try-with-resources statement"
|
|
),
|
|
"location": f"offset {match.start()}",
|
|
})
|
|
|
|
# Heavy object built per use instead of shared as a singleton.
|
|
# A `static` field assignment is the recommended singleton form — skip it.
|
|
heavy_object = re.compile(
|
|
r"^(?!.*\bstatic\b).*\bnew\s+(ObjectMapper|Gson)\s*\(\s*\)",
|
|
re.MULTILINE,
|
|
)
|
|
for match in heavy_object.finditer(content):
|
|
smells.append({
|
|
"type": "java_per_use_heavy_object",
|
|
"severity": "medium",
|
|
"message": (
|
|
f"'new {match.group(1)}()' is expensive — share a singleton "
|
|
"instance instead of constructing per call"
|
|
),
|
|
"location": f"offset {match.start()}",
|
|
})
|
|
|
|
return smells
|
|
|
|
|
|
def check_c_specific_smells(content: str) -> List[Dict]:
|
|
"""C-specific code smells documented in languages/c.md.
|
|
|
|
Focuses on memory-safety and command/format-string patterns that the
|
|
CERT C Coding Standard and the CWE catalogue rank as the
|
|
highest-impact footguns. C uses the same line/block comment syntax as
|
|
C# and Java, so the existing comment stripper applies.
|
|
"""
|
|
smells: List[Dict] = []
|
|
content = _strip_csharp_comments(content)
|
|
|
|
# 1. Banned functions — no bounds check on any of them.
|
|
banned = {
|
|
"gets": "no bounds check, removed from C11 (CWE-242)",
|
|
"strcpy": "no bounds check — prefer strncpy or strlcpy",
|
|
"strcat": "no bounds check — prefer strncat or strlcat",
|
|
"sprintf": "no bounds check — prefer snprintf",
|
|
"vsprintf": "no bounds check — prefer vsnprintf",
|
|
}
|
|
for fn, reason in banned.items():
|
|
for m in re.finditer(rf"\b{fn}\s*\(", content):
|
|
smells.append({
|
|
"type": f"c_banned_{fn}",
|
|
"severity": "high",
|
|
"message": f"'{fn}()' is unsafe: {reason}",
|
|
"location": f"offset {m.start()}",
|
|
})
|
|
|
|
# 2. Format-string vulnerability — printf/syslog called with a bare
|
|
# identifier as the format argument (CWE-134). Skip when the first
|
|
# arg is a string literal.
|
|
for fn in ("printf", "syslog"):
|
|
pattern = rf"\b{fn}\s*\(\s*(?!\")(\w+)\s*[,\)]"
|
|
for m in re.finditer(pattern, content):
|
|
smells.append({
|
|
"type": "c_format_string",
|
|
"severity": "high",
|
|
"message": (
|
|
f"'{fn}({m.group(1)})' uses a non-literal format string "
|
|
"— CWE-134 format string vulnerability"
|
|
),
|
|
"location": f"offset {m.start()}",
|
|
})
|
|
|
|
# 3. Unbounded scanf — `%s` without a width specifier invites overflow.
|
|
scanf_call = re.compile(
|
|
r"\b(?:scanf|fscanf|sscanf)\s*\(\s*[^)]*?\"([^\"]*)\""
|
|
)
|
|
for m in scanf_call.finditer(content):
|
|
fmt = m.group(1)
|
|
if "%s" in fmt and not re.search(r"%\d+s", fmt):
|
|
smells.append({
|
|
"type": "c_unbounded_scanf",
|
|
"severity": "high",
|
|
"message": (
|
|
"scanf '%s' without a width specifier — unbounded read "
|
|
"can overflow the destination buffer"
|
|
),
|
|
"location": f"offset {m.start()}",
|
|
})
|
|
|
|
# 4. malloc / calloc / realloc result dereferenced without a NULL check
|
|
# within 5 lines. CWE-690.
|
|
lines = content.split("\n")
|
|
malloc_assign = re.compile(
|
|
r"^\s*(?:[\w\*]+\s+)?\*?(\w+)\s*=\s*\(?[\w\s\*]*\)?\s*"
|
|
r"(?:m|c|re)alloc\s*\("
|
|
)
|
|
for i, line in enumerate(lines):
|
|
m = malloc_assign.match(line)
|
|
if not m:
|
|
continue
|
|
var = m.group(1)
|
|
window = "\n".join(lines[i + 1 : i + 6])
|
|
null_check = re.compile(
|
|
rf"\bif\s*\([^)]*(?:{re.escape(var)}\s*==\s*NULL"
|
|
rf"|NULL\s*==\s*{re.escape(var)}"
|
|
rf"|!\s*{re.escape(var)}\b"
|
|
rf"|{re.escape(var)}\s*!=\s*NULL)"
|
|
)
|
|
if not null_check.search(window):
|
|
smells.append({
|
|
"type": "c_malloc_unchecked",
|
|
"severity": "medium",
|
|
"message": (
|
|
f"'{var}' from malloc/calloc/realloc is not NULL-checked "
|
|
"within 5 lines — dereferencing NULL is UB (CWE-690)"
|
|
),
|
|
"location": f"line {i + 1}",
|
|
})
|
|
|
|
# 5. free(p) without setting p to NULL on the next real line.
|
|
# CWE-416 use-after-free guardrail.
|
|
free_call = re.compile(r"^\s*free\s*\(\s*(\w+)\s*\)\s*;")
|
|
for i, line in enumerate(lines):
|
|
m = free_call.match(line)
|
|
if not m:
|
|
continue
|
|
var = m.group(1)
|
|
for j in range(i + 1, min(i + 3, len(lines))):
|
|
nxt = lines[j].strip()
|
|
if not nxt:
|
|
continue
|
|
if re.match(rf"^{re.escape(var)}\s*=\s*NULL\s*;", nxt):
|
|
break
|
|
smells.append({
|
|
"type": "c_free_without_null",
|
|
"severity": "low",
|
|
"message": (
|
|
f"'free({var})' not followed by '{var} = NULL;' — "
|
|
"dangling pointer can be reused (CWE-416)"
|
|
),
|
|
"location": f"line {i + 1}",
|
|
})
|
|
break
|
|
|
|
# 6. system() with a non-string-literal argument — command injection.
|
|
system_pattern = re.compile(r"\bsystem\s*\(\s*(?!\"|NULL\b)(\w+)\s*\)")
|
|
for m in system_pattern.finditer(content):
|
|
smells.append({
|
|
"type": "c_system_non_literal",
|
|
"severity": "high",
|
|
"message": (
|
|
f"'system({m.group(1)})' with a non-literal argument — "
|
|
"command injection (CWE-78); use execve with validated args"
|
|
),
|
|
"location": f"offset {m.start()}",
|
|
})
|
|
|
|
return smells
|
|
|
|
|
|
def check_solid_violations(content: str) -> List[Dict]:
|
|
"""Check for potential SOLID principle violations."""
|
|
violations = []
|
|
|
|
# OCP: Type checking instead of polymorphism
|
|
type_checks = len(re.findall(r"isinstance\(|type\(.*\)\s*==|typeof\s+\w+\s*===", content))
|
|
if type_checks > 2:
|
|
violations.append({
|
|
"principle": "OCP",
|
|
"name": "Open/Closed Principle",
|
|
"severity": "medium",
|
|
"message": f"Found {type_checks} type checks - consider using polymorphism"
|
|
})
|
|
|
|
# LSP/ISP: NotImplementedError
|
|
not_impl = len(re.findall(r"raise\s+NotImplementedError|not\s+implemented", content, re.IGNORECASE))
|
|
if not_impl:
|
|
violations.append({
|
|
"principle": "LSP/ISP",
|
|
"name": "Liskov/Interface Segregation",
|
|
"severity": "low",
|
|
"message": f"Found {not_impl} unimplemented methods - may indicate oversized interface"
|
|
})
|
|
|
|
# DIP: Too many direct imports
|
|
imports = len(re.findall(r"^(?:import|from)\s+", content, re.MULTILINE))
|
|
if imports > THRESHOLDS["max_imports"]:
|
|
violations.append({
|
|
"principle": "DIP",
|
|
"name": "Dependency Inversion Principle",
|
|
"severity": "low",
|
|
"message": f"File has {imports} imports - consider dependency injection"
|
|
})
|
|
|
|
return violations
|
|
|
|
|
|
def calculate_quality_score(
|
|
line_metrics: Dict,
|
|
functions: List[Dict],
|
|
classes: List[Dict],
|
|
smells: List[Dict],
|
|
violations: List[Dict]
|
|
) -> int:
|
|
"""Calculate overall quality score (0-100)."""
|
|
score = 100
|
|
|
|
# Deduct for code smells
|
|
for smell in smells:
|
|
if smell["severity"] == "high":
|
|
score -= 10
|
|
elif smell["severity"] == "medium":
|
|
score -= 5
|
|
elif smell["severity"] == "low":
|
|
score -= 2
|
|
|
|
# Deduct for SOLID violations
|
|
for violation in violations:
|
|
if violation["severity"] == "high":
|
|
score -= 8
|
|
elif violation["severity"] == "medium":
|
|
score -= 4
|
|
elif violation["severity"] == "low":
|
|
score -= 2
|
|
|
|
# Bonus for good comment ratio (10-30%)
|
|
if line_metrics["total"] > 0:
|
|
comment_ratio = line_metrics["comment"] / line_metrics["total"]
|
|
if 0.1 <= comment_ratio <= 0.3:
|
|
score += 5
|
|
|
|
# Bonus for reasonable function sizes
|
|
if functions:
|
|
avg_lines = sum(f["lines"] for f in functions) / len(functions)
|
|
if avg_lines < 30:
|
|
score += 5
|
|
|
|
return max(0, min(100, score))
|
|
|
|
|
|
def get_grade(score: int) -> str:
|
|
"""Convert score to letter grade."""
|
|
if score >= 90:
|
|
return "A"
|
|
elif score >= 80:
|
|
return "B"
|
|
elif score >= 70:
|
|
return "C"
|
|
elif score >= 60:
|
|
return "D"
|
|
else:
|
|
return "F"
|
|
|
|
|
|
def analyze_file(filepath: Path) -> Dict:
|
|
"""Analyze a single file for code quality."""
|
|
language = detect_language(filepath)
|
|
if not language:
|
|
return {"error": f"Unsupported file type: {filepath.suffix}"}
|
|
|
|
content = read_file_content(filepath)
|
|
if not content:
|
|
return {"error": f"Could not read file: {filepath}"}
|
|
|
|
line_metrics = count_lines(content)
|
|
functions = find_functions(content, language)
|
|
classes = find_classes(content, language)
|
|
smells = check_code_smells(content, functions, classes)
|
|
if language == "csharp":
|
|
smells.extend(check_csharp_specific_smells(content))
|
|
if language == "java":
|
|
smells.extend(check_java_specific_smells(content))
|
|
if language == "c":
|
|
smells.extend(check_c_specific_smells(content))
|
|
violations = check_solid_violations(content)
|
|
score = calculate_quality_score(line_metrics, functions, classes, smells, violations)
|
|
|
|
return {
|
|
"file": str(filepath),
|
|
"language": language,
|
|
"metrics": {
|
|
"lines": line_metrics,
|
|
"functions": len(functions),
|
|
"classes": len(classes),
|
|
"avg_complexity": round(sum(f["complexity"] for f in functions) / max(1, len(functions)), 1)
|
|
},
|
|
"quality_score": score,
|
|
"grade": get_grade(score),
|
|
"smells": smells,
|
|
"solid_violations": violations,
|
|
"function_details": functions[:10],
|
|
"class_details": classes[:10]
|
|
}
|
|
|
|
|
|
def analyze_directory(
|
|
dir_path: Path,
|
|
recursive: bool = True,
|
|
language: Optional[str] = None
|
|
) -> Dict:
|
|
"""Analyze all files in a directory."""
|
|
results = []
|
|
extensions = []
|
|
|
|
if language:
|
|
extensions = LANGUAGE_EXTENSIONS.get(language, [])
|
|
else:
|
|
for exts in LANGUAGE_EXTENSIONS.values():
|
|
extensions.extend(exts)
|
|
|
|
pattern = "**/*" if recursive else "*"
|
|
|
|
for ext in extensions:
|
|
for filepath in dir_path.glob(f"{pattern}{ext}"):
|
|
if "node_modules" in str(filepath) or ".git" in str(filepath):
|
|
continue
|
|
result = analyze_file(filepath)
|
|
if "error" not in result:
|
|
results.append(result)
|
|
|
|
if not results:
|
|
return {"error": "No supported files found"}
|
|
|
|
total_score = sum(r["quality_score"] for r in results)
|
|
avg_score = total_score / len(results)
|
|
total_smells = sum(len(r["smells"]) for r in results)
|
|
total_violations = sum(len(r["solid_violations"]) for r in results)
|
|
|
|
return {
|
|
"directory": str(dir_path),
|
|
"files_analyzed": len(results),
|
|
"average_score": round(avg_score, 1),
|
|
"overall_grade": get_grade(int(avg_score)),
|
|
"total_code_smells": total_smells,
|
|
"total_solid_violations": total_violations,
|
|
"files": sorted(results, key=lambda x: x["quality_score"])
|
|
}
|
|
|
|
|
|
def print_report(analysis: Dict) -> None:
|
|
"""Print human-readable analysis report."""
|
|
if "error" in analysis:
|
|
print(f"Error: {analysis['error']}")
|
|
return
|
|
|
|
print("=" * 60)
|
|
print("CODE QUALITY REPORT")
|
|
print("=" * 60)
|
|
|
|
if "file" in analysis:
|
|
print(f"\nFile: {analysis['file']}")
|
|
print(f"Language: {analysis['language']}")
|
|
print(f"Quality Score: {analysis['quality_score']}/100 ({analysis['grade']})")
|
|
|
|
metrics = analysis["metrics"]
|
|
print(f"\nLines: {metrics['lines']['total']} ({metrics['lines']['code']} code, {metrics['lines']['comment']} comments)")
|
|
print(f"Functions: {metrics['functions']}")
|
|
print(f"Classes: {metrics['classes']}")
|
|
print(f"Avg Complexity: {metrics['avg_complexity']}")
|
|
|
|
if analysis["smells"]:
|
|
print("\n--- CODE SMELLS ---")
|
|
for smell in analysis["smells"][:10]:
|
|
print(f" [{smell['severity'].upper()}] {smell['message']} ({smell['location']})")
|
|
|
|
if analysis["solid_violations"]:
|
|
print("\n--- SOLID VIOLATIONS ---")
|
|
for v in analysis["solid_violations"]:
|
|
print(f" [{v['principle']}] {v['message']}")
|
|
else:
|
|
print(f"\nDirectory: {analysis['directory']}")
|
|
print(f"Files Analyzed: {analysis['files_analyzed']}")
|
|
print(f"Average Score: {analysis['average_score']}/100 ({analysis['overall_grade']})")
|
|
print(f"Total Code Smells: {analysis['total_code_smells']}")
|
|
print(f"Total SOLID Violations: {analysis['total_solid_violations']}")
|
|
|
|
print("\n--- FILES BY QUALITY ---")
|
|
for f in analysis["files"][:10]:
|
|
print(f" {f['quality_score']:3d}/100 [{f['grade']}] {f['file']}")
|
|
|
|
print("\n" + "=" * 60)
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(
|
|
description="Analyze code quality, smells, and SOLID violations"
|
|
)
|
|
parser.add_argument(
|
|
"path",
|
|
help="File or directory to analyze"
|
|
)
|
|
parser.add_argument(
|
|
"--recursive", "-r",
|
|
action="store_true",
|
|
default=True,
|
|
help="Recursively analyze directories (default: true)"
|
|
)
|
|
parser.add_argument(
|
|
"--language", "-l",
|
|
choices=list(LANGUAGE_EXTENSIONS.keys()),
|
|
help="Filter by programming language"
|
|
)
|
|
parser.add_argument(
|
|
"--json",
|
|
action="store_true",
|
|
help="Output in JSON format"
|
|
)
|
|
parser.add_argument(
|
|
"--output", "-o",
|
|
help="Write output to file"
|
|
)
|
|
|
|
args = parser.parse_args()
|
|
|
|
target = Path(args.path).resolve()
|
|
|
|
if not target.exists():
|
|
print(f"Error: Path does not exist: {target}", file=sys.stderr)
|
|
sys.exit(1)
|
|
|
|
if target.is_file():
|
|
analysis = analyze_file(target)
|
|
else:
|
|
analysis = analyze_directory(target, args.recursive, args.language)
|
|
|
|
if args.json:
|
|
output = json.dumps(analysis, indent=2, default=str)
|
|
if args.output:
|
|
with open(args.output, "w") as f:
|
|
f.write(output)
|
|
print(f"Results written to {args.output}")
|
|
else:
|
|
print(output)
|
|
else:
|
|
print_report(analysis)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|