Static code testing of active code
A code deployment system deploys code to a set of application systems that execute the application, which may be across several tiers of systems that service requests related to the application. At each system, the application executes and is analyzed during execution to determine active code that is loaded by the application during execution, which may include dynamically-generated code. The active code is then analyzed using static analysis to determine security vulnerabilities and errors in the code that was loaded and operated at each application tier. The active code may also be associated with a specific use case or set of inputs that were applied to the application during the monitoring.
1. A method for automated application testing of computer code comprising:
receiving deployed code of an application for execution at a computing system;
prior to executing the deployed code, adding breaking points to the deployed code;
executing the deployed code at the computing system;
during execution of the deployed code, monitoring the execution of the deployed code to identify active code from the deployed code, the identified active code loaded in a memory of the computing system for execution by the computing system during execution of the application,
the identified active code including computer-executable instruction to be executed by the computing system;
sending the identified active code that is loaded in the memory of the computing system for executing by the computing system to a code testing module; and
performing, by the code testing module, static analysis on the identified active code previously loaded in the memory of the computing system for execution by the computing system, the static analysis of the identified active code performed without executing the identified active code.
2. The method of claim 1 , wherein the code is monitored during a set of input requests defining a use case for the application.
3. The method of claim 2 , wherein the set of input requests are automatically generated.
4. The method of claim 1 , wherein the monitoring comprises identifying active code when the breakpoints are reached in execution of the deployed code.
5. The method of claim 4 , wherein the monitoring is performed by a separate process from the deployed code.
6. The method of claim 1 , wherein monitoring the deployed code comprises instrumenting function calls of the deployed code.
7. The method of claim 6 , wherein the function calls comprise library or system functions.
8. The method of claim 1 , wherein the deployed code is a portion of the code for an application and other deployed code is provided to another system that identifies test code for the other system.
9. The method of claim 1 , wherein the monitoring of the deployed code is performed via a remote connection by another computing system.
10. A non-transitory computer-readable medium comprising instructions that, when executed by a processor, cause the processer to perform steps of:
receiving deployed code of an application for execution at a computing system;
prior to executing the deployed code, adding breaking points to the deployed code;
executing the deployed code at the computing system;
during execution of the deployed code, monitoring the execution of the deployed code to identify active code from the deployed code, the identified active code loaded in a memory of the computing system for execution by the computing system during execution of the application, the identified active code including computer-executable instruction to be executed by the computing system;
sending the identified active code that is loaded in the memory of the computing system for executing by the computing system to a code testing module; and performing, by the code testing module,
static analysis on the identified active code previously loaded in the memory of the computing system for execution by the computing system without executing the identified active code.
11. The non-transitory computer-readable medium of claim 10 , wherein the code is monitored during a set of input requests defining a use case for the application.
12. The non-transitory computer-readable medium of claim 11 , wherein the set of input requests are automatically generated.
13. The non-transitory computer-readable medium of claim 10 , wherein the monitoring comprises identifying active code when the breakpoints are reached in execution of the deployed code.
14. The non-transitory computer-readable medium of claim 13 , wherein the monitoring is performed by a separate process from the deployed code.
15. The non-transitory computer-readable medium of claim 10 , wherein monitoring the deployed code comprises instrumenting function calls of the deployed code.
16. The non-transitory computer-readable medium of claim 15 , wherein the function calls comprise library or system functions.
17. The non-transitory computer-readable medium of claim 10 , wherein the deployed code is a portion of the code for an application and other deployed code is provided to another system that identifies test code for the other system.
18. The non-transitory computer-readable medium of claim 10 , wherein the monitoring of the deployed code is performed via a remote connection by another computing system.