Version 2.6.0
Table of Contents Introduction Installation Settings Running Julia Navigating the Results Managing analyses results Extraction of the application under analysis Julia Java Project Wizard Julia Android Project wizard Additional features and tools Compute Metrics 3 3 4 5 7 9 10 10 12 14 14 2
Introduction This user guide presents the Eclipse plugin of Julia. Julia is a sta c analyzer that automa cally performs seman c analysis of Java code. The Eclipse plugin allows a user to (i) set up the URL of the Julia Server and her creden als, (ii) select the op ons of the analysis and run it, and (iii) inspect the results. In addi on, this user guide explains step-by-step how to install the plugin. Installation First of all, you need to install the plugin by clicking Help from the bar menu, and then Install New Software. An Install panel will appear. From there, fill the Work with text field with the URL h p://sta c.juliaso.com/eclipseplugin/latest/, then click Add, and select a name A er clicking Ok, in the central part of the Install panel the components of the Julia plugin will appear. Just click Next to go ahead with the installation. 3
Click Next in the panel about the install details. Finally, you have to accept the license and click Finish to start the download and installa on of the Julia plugin. At the end of the installation, you will need to restart Eclipse. Settings The menu bar will now contain a new menu Julia : - Analyze with Julia will open the panel to set up and start the analysis, - Show Julia Analysis View will open in the view panel the Julia Analysis view (see "Accessing the results for more details), - Import Analysis from File will allow you to load the results of previous analyses saved in a.xml file, - Retrieve Analysis from Server will allow you to 4
load the results of previous analyses, and - Preferences will open a panel to specify the server and the creden als to run the analysis (see below). In the Preferences panel, you can specify the URL of the Julia Analyzer (https://portal.juliasoft.com/services/pluginservice for the cloud service), your access and secret key, and you can acquire your list of solu ons and select one of them. Furthermore, in this panel you can also specify the port number for incoming requests (or let the system choose an available port number), which is only necessary during web view naviga on (i.e. flow graphs view). Running Julia You have two ways to run Julia: 1) From the menu bar, click Julia and then "Analyze with Julia" 2) Click the Julia icon 5
When star ng the analysis the Julia Analysis wizard will appear. From here, you have to select the projects you want to analyze (le part), the dependencies to include (right part) and the op on to include.proper es files launching the analysis. Then you can click Next. The second step lets you choose what entry points the analysis should consider (for more details see the sec on Extrac on of the applica on under analysis ), the Julia framework against with the analysis will be done, the processing mode to be used for libraries and finally the way the analysis has to threat asser on statements. Then you can click Next. The third and last step before running the analysis is to select the checkers you want to apply; checkers are represented in a tree view (le part) and many of them have some op ons (their children). We strongly encourage to run only the Basic checkers as default, and run more Advanced checkers only if needed. Julia s website contains the exhaus ve explana on of all Julia checkers. Once you select a checker, you may choose to select some of its options too (its children in the tree); the right panel will always help you showing a brief explana on of the currently selected checker/op on in the tree. For each op on, you can select a specific value (e.g., true or false) through a drop down menu at the bo om. In the bottom left part you can Save or load configurations, i.e., entry points and checkers the analysis will apply. Finally, the analysis can be launched by clicking Finish. 6
A dialog will tell you how many credits the analysis will cost. If you want to proceed, click Ok and the credit will be deducted from you account. Otherwise, click Cancel and the credits will not be debited. During the analysis, in the bo om Julia view you can monitor the status of the analysis. It will become green once the analysis will be finished. You can monitor the progresses of the analysis in the console. Navigating the Results At the end of the analysis, the view Julia Analyses will show the results. In par cular, in the le part you can access the list of analyses you ran. Once chosen one of them, the central part of the view will display all the warnings in a tree structure. You can then inspect the warnings produced by different checkers, on different packages, etc If you double click on a warning, the line of the source code that produced that warning is displayed. Finally, the right part of the Julia analyses panel shows the details of the warning. The Eclipse code editor contains markers on the le bar to iden fy the code lines that raised a warning. Different colors represent different severi es (red for high, yellow for medium, and green for low severity). 7
You can decide to group the warnings in the central panel of the Julia view in different ways. Just click and a dialog showing all the grouping possibili es will appear. You can decide the order and the types of categories you want to apply to group warnings. The warnings will be then displayed with the new grouping in the central panel. In the context of flow analyses (including GDPR checker), the rightmost column of the Julia Analyses View lets you navigate analysis flows. A er selec ng a warning on the tree, you can view its flows clicking on the Show bu on that appears at the end of the analysis proper es; a new dialog will list the flows related to the selected warning allowing to open a single graph in a web browser view. 8
The graph can be explored at the desired level: available levels are Package, Class, Method, Source Line or Statement. This view also lets you reach the line of the source code a given node of the graph refers to, this can be done by right clicking on the node itself, only for Line or Statement nodes. Managing analyses results In the le part of the Julia analyses view, you can select among all the analyses you ran. Each me you click on an analysis, the warnings tree will be loaded, and the markers will be updated to the ones of the selected analysis. If you right click the name of the analysis in the le panel, you can Reload from the server the analysis results. This feature is par cularly useful if you exit the IDE while the analysis is running, and you want to load the results later. In addition, from this drop-down menu you can also copy the analysis ID, rename or delete the analysis and open the analysis detail in the Julia Web Console. You can export the result of the analysis: click and select where to save the.xml file. You can import the results of a completed analysis through 1) an.xml file by clicking and selec ng the file you want to import 9
2) by clicking Retrieve Analysis from Server from the Julia s Menu bar, and then selec ng the analysis you want to load from the list of the analyses available on server for your current Ac ve Solution. The pdf report of the analysis can be downloaded by clicking Save generated files and then the report you want to download. You can manage the markers from the standard Markers Eclipse view (accessible from Show View of the Window menu bar). From here, you can also delete a marker. This will be removed from the Julia Analyses view as well. Extraction of the application under analysis The Julia analyzer computes a set of methods and constructors that are assumed to be callable from the user of the program under analysis. They are called entry points. This means that the sta c analysis is performed as if the entry points were the only methods that can be called from the user of the code. Of course, if the entry points call other methods, these other methods are analyzed as well, and so on. Julia selects the set of entry points according to three possible alternatives: 1. Only main. With this modality, Julia automa cally selects as entry points the main() methods and all methods that override a library method, such as run() methods of threads or equals() methods. This also includes event handlers of Swing or Android. Moreover, entry points explicitly marked as such by the programmer are considered. 2. All public entries. With this modality, Julia automa cally selects as entry points those selected with the previous modality, plus all public methods and constructors. 3. All accessible. With this modality, Julia behaves as in the previous modality but assumes that non-final methods can be redefined in subclasses. This allows one to analyze classes that are expected to be subclassed by the user of the code. Note, however, that this reduces the precision of the analysis, since most data flow inferences cannot be performed anymore (the code might change its behavior by subclassing). 10
Julia Java Project Wizard The Eclipse plugin of Julia comes with a project wizard that helps during the crea on of a java project that acts as container for third-party classes and sources that you would like to put under analysis. Open the Eclipse New Wizard window (Ctrl + N) and select Julia Java Project from the list, then click "Next" Fill the Project Name text and op onally specify a different location for the project, then click "Next" Select the folder for classes and op onally the folder for sources; through the Link classes and Link sources checkboxes you may opt to 11
physically copy classes and/or sources within your project or just link them. Moreover, if your classes and sources come from the same folder, you just have to select Sources and classes share the same path once entered classes path. Finally click "Finish" If specified paths really contain expected resources, you will find the new project within the Eclipse workspace; in this example, the sources folder has been created as a link folder 12
Note that projects created through this wizard has inten onally no Java Builder associated, therefore no compila on phase will ever be involved le ng class files stay unaltered. Julia Android Project wizard The Julia plugin also lets you create a par cular Eclipse project star ng from either an apk file or the Android Studio/Gradle build output; this way it is possible to submit a Julia analysis in typical Android scenarios without the need of the complete development toolchain installed in your machine (i.e. a release from a separate supplier/department). Open the Eclipse New Wizard window (Ctrl + N) and select Julia Android Project from the list, then click "Next" 13
Fill the Project Name text and op onally specify a different location for the project, then click "Next" According to the scenario you are facing with, you may now choose to specify what you want to analyze in two dis nct ways: providing the apk file of your app or specifying the classes folder of the Android build process output. In both these situa ons you must also specify the framework against with the analysis will be done. In the first case, once the apk file has been specifyed, the correct Framework is automa cally preselected deriving it from the contained AndroidManifest.xml. In the second case, you are asked to provide both the path of your classes and the AndroidManifest.xml of the app. Again, once specified, the Framework field will be automa cally filled. Depending on your needs you are always free to choose a different framework version. Finally, you can op onally specify the folder for sources; through the Link sources checkbox you may opt to physically copy sources within your project or just link them. Finally click Finish. Additional features and tools Compute Metrics The Eclipse plugin of Julia provides an utility that let you obtain some metrics before the submit of an analysis, to evaluate in advance the logical and physical source size of your project. 14
Right click on a project (from the Package Explorer view) and choose Julia, then Compute Metrics Requested metrics will soon be visualized in a separated window, ready for your evaluation. 15
JuliaSoft is an innovative technology company specialized in advanced code analysis solutions. For more information on the technology and our solutions please visit our website at www.juliasoft.com For any information please don t hesitate to contact us: JULIASOFT SRL Management and Coordination by Corvallis Holding S.p.A. Lungadige Galtarossa, 21 37133 Verona, Italy Tel +39 045 2081901 info@juliasoft.com For technical support please write to support@juliasoft.com 16