Lightweight Multilingual Software Analysis

Abstract

Developer preferences, language capabilities and the persistence of older languages contribute to the trend that large software codebases are often multilingual -that is, written in more than one computer language. While developers can leverage monolingual software development tools to build software components, companies are faced with the problem of managing the resultant large, multilingual codebases to address issues with security, efficiency, and quality metrics. The key challenge is to address the opaque nature of the language interoperability interface: one language calling procedures in a second (which may call a third, or even back to the first), resulting in a potentially tangled, inefficient and insecure codebase. An architecture is proposed for lightweight static analysis of large multilingual codebases -the MLSA architecture. Its modular and table-oriented structure addresses the open-ended nature of multiple languages and language interoperability APIs. We focus here as an application on the construction of call-graphs that capture both inter-language and intra-language calls. The algorithms for extracting multilingual call-graphs from codebases are presented, and several examples of multilingual software engineering analysis are discussed. The state of the implementation and testing of MLSA is presented, and the implications for future work are discussed.1. The procedure-based interoperability API call is tested for in line 3 (e.g., PyObject_CallObject) 2. The name of the procedure, if it is statically available, is added to the modified call-graph CGM at lines 8 and 11, and the arguments to the procedure are modified to omit the first argument. 3. The node is labelled "ProcBased-Dynamic" at line 6 This algorithm does not include several steps typically associated with procedure-based interoperability calls. Continuing our python.h example:

Towards Lakosian Multilingual Software Design Principles

“…Modern software development is increasingly multilingual: Developers might build a software project from different language components for functionality or style reasons. In prior work (Lyons, Bogar and Baird 2017) , we have looked at the problem of providing tools for analyzing multilingual code bases to address software engineering and security concerns. We proposed a software architecture for lightweight multilingual software analysis toolsthe MLSA architecture and introduced some tools for generating multilingual call-graphs, which we argued can be the basis for the addressing many useful software engineering and security concerns.…”

“…We have argued in prior work (Lyons, Bogar and Baird 2017) ) that call-graph analysis is one productive tool for investigating software engineering properties of multilingual code, and we have focused our research on what is required to construct a multilingual call-graph. In addition to the challenges of monolingual call-graph construction, e.g., (Ali and Lhotak 2012) (Bacon and Sweeney 1996) , multilingual call graphs have to include edges that span one language to a second.…”

“…Multilingual software with the Foreign Function Interface (FFI) is introduced in Section 3 with pybind11 as a specific example. The MLSA (Multilingual Software Analysis) toolkit (Lyons, Bogar and Baird 2017) , which will be used to investigate FFI usage in a collection of pybind11 repositories, is introduced in Section 4. Some common FFI practices will be identified that show analogous troublesome linkages to those first identified by Lakos in C++ physical design.…”