Running static code analysis
Static code analysis is a debugging method that is performed without running the code. With application security taking center stage, it is very important to catch potential vulnerabilities early in the development phase and address them as you build your application code. Static code analysis helps developers catch issues such as the following:
- Coding standard violations
- Security vulnerabilities
- Programming errors
There are several tools available for static code analysis. For this book, we are going to look at SonarQube, which can analyze over 30 different programming languages and is one of the most widely adopted tools for static code analysis.
Installing SonarQube locally
The easiest way to install SonarQube is to launch it as a Docker container using the following command:
docker run -d --name sonarqube -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -p 9000:9000 sonarqube:latest
Once installed, open http://localhost:9000...
