Sorald：SonarQube静态分析违规的自动修补程序建议
Sorald: Automatic Patch Suggestions for SonarQube Static Analysis Violations
摘要：
以前的工作表明，早期解决静态代码分析器检测到的问题可以防止以后的重大成本。首先，应该解释许多问题，以确定它们是否对应于程序中的实际缺陷。其次，静态分析师通常不会以可操作的方式呈现问题。为了解决这些问题，我们提出了Sorald：一个新的系统，设计元编程模板转换的抽象语法树的程序，并建议修复静态分析警告。因此，开发人员的负担减轻了，从解释和修复静态问题，到检查和批准完整的解决方案。Sorald修复了SonarJava的10条规则，SonarJava是Java最广泛使用的静态分析器之一。我们在Github上的161个流行仓库的数据集上评估了Sorald。我们的分析显示了Sorald的有效性，因为它修复了65%（852/1，307）满足修复先决条件的违规行为。总的来说，我们的实验表明，可以自动修复由最先进的静态分析器SonarJava产生的静态分析规则的明显违规。
英文摘要：
Previous work has shown that early resolution of issues detected by static code analyzers can prevent major costs later on. However, developers often ignore such issues for two main reasons. First, many issues should be interpreted to determine if they correspond to actual flaws in the program. Second, static analyzers often do not present the issues in a way that is actionable. To address these problems, we present Sorald: a novel system that devise metaprogramming templates to transform the abstract syntax trees of programs and suggest fixes for static analysis warnings. Thus, the burden on the developer is reduced from interpreting and fixing static issues, to inspecting and approving full fledged solutions. Sorald fixes violations of 10 rules from SonarJava, one of the most widely used static analyzers for Java. We evaluate Sorald on a dataset of 161 popular repositories on Github. Our analysis shows the effectiveness of Sorald as it fixes 65% (852/1,307) of the violations that meets the repair preconditions. Overall, our experiments show it is possible to automatically fix notable violations of the static analysis rules produced by the state-of-the-art static analyzer SonarJava.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
