|
|
 |
C, C++, C# Á¤ÀûºÐ¼®µµ±¸ - »ê¾÷º° Ç¥ÁØ Áö¿ø
C, C++, C# Á¤ÀûºÐ¼®µµ±¸´Â ÄÄÆÄÀÏ °úÁ¤ ¾øÀÌ ¿ø½Ã ¼Ò½ºÄڵ带 ºÐ¼®Çϰí, ÃÖ»óÀ§ ÄÚµå ºÐ¼® ±â¼úÀÎ Concrete Data & Control/Data Flow Analysis ±â¹Ý Inter-procedural Path Analysis(feasible path, call, return)ÀÇ ÄÚµå °ËÁõÀ¸·Î, ½Å·Ú¼º(ÄÚµù °¡À̵å), ¾ÈÀü¼º(Run-time Error), º¸¾È¼º(º¸¾È Ãë¾àÁ¡), ÄÚµå ǰÁú(ÄÚµå º¹Àâµµ)¸¦ ¸ðµÎ Á¡°ËÇÏ´Â ÅëÇÕ Á¤ÀûºÐ¼®µµ±¸ÀÔ´Ï´Ù.
ÀÓº£µðµå ÄÚµù °¡À̵åÀÎ MISRA-C & MISRA-C++Àº ÄÚµåÀÇ ½Å·Ú¼º°ú ¾ÈÁ¤¼ºÀ» °ËÁõÇϱâ À§Çؼ, ÀÚµ¿Â÷, ÀüÀÚ, ¿ìÁÖ Ç×°ø, Åë½Å, ÀÇ·á, ±¹¹æ µî Á¦Á¶ ºÐ¾ß¿¡¼ ÀÓº£µðµå ½Ã½ºÅÛ °³¹ßÀÇ ÄÚµù Ç¥ÁØÀ¸·Î ³Î¸® »ç¿ëÇϰí ÀÖ½À´Ï´Ù.
ÃÖ±Ù, ³»¿¬±â°üÂ÷¿¡¼ Àü±âÂ÷·Î ´ëÀüȯÇÏ´Â °úÁ¤¿¡¼ ¹Ì·¡ ÀÚµ¿Â÷ Â÷·®¿¡ žÀçµÇ´Â ÀÚÀ² ÁÖÇà, °øÀ¯¼ºñ½º µîÀÇ ¼ÒÇÁÆ®¿þ¾î¿¡ ´ëÇÑ ½Å·Ú¼º°ú º¸¾È¼ºÀ» ³ôÀ̱â À§ÇØ Â÷·®¿ë ÀÓº£µðµå ¼ÒÇÁÆ®¿þ¾î¿¡¼ ¿ä±¸µÇ´Â Á¤º¸º¸È£ ¼ºñ½º(±â¹Ð¼º, ¹«°á¼º, °¡¿ë¼º, ÀÎÁõ)ÀÇ È®º¸°¡ ÄÚµù ´Ü°è¿¡¼ ÇʼöÀûÀ¸·Î ¿ä±¸µÇ°í ÀÖ½À´Ï´Ù.
|
 |
±¹³»¿Ü »ê¾÷ Ç¥ÁØ Áö¿ø
ÄÚµù °¡À̵å Á¡°Ë: MISRA-C/C++, AUTOSAR C++, JPL-C, MS C# Coding Convention µî
Run-time Error Á¡°Ë: CWE-658 (C: 83 ±ÔÄ¢), CWE-659 (C++: 87 ±ÔÄ¢)
(±¹¿Ü) º¸¾È Ãë¾àÁ¡ Á¡°Ë: CWE, OWASP, CERT-C/C++
(±¹³») º¸¾È Ãë¾àÁ¡ Á¡°Ë: ÀüÀÚ±ÝÀ¶°¨µ¶±ÔÁ¤, ±ÝÀ¶È¸»ç ITºÎ¹®º° Ãë¾àÁ¡, ±¹Á¤¿ø Ãë¾àÁ¡, Çà¾ÈºÎ °³¹ß º¸¾È °¡À̵å(C/C++: 49±ÔÄ¢)
¹æ»çû ¹«±âü°è SW Á¤Àû ½ÃÇè Á¡°Ë: C, C++, C# ÄÚµù±ÔÄ¢, CWE-658/659, Code Metrics
Â÷·®¿ë ÀÓº£µðµå C ÄÚµå °ËÁõ: MISRA-C, Run-time Error, Code Metrics
Â÷·®¿ë ÀÓº£µðµå C º¸¾È ÄÚµù Á¡°Ë: CERT-C, CWE
Â÷·®¿ë ÀÓº£µðµå C++ ÄÚµå °ËÁõ: MISRA-C++, Run-time Error, AUTOSAR C++14, CodeMetrics
Â÷·®¿ë ÀÓº£µðµå C++ º¸¾È ÄÚµù Á¡°Ë: CERT-C++, CWE
(Other Code Assurance) SQL, Code Metrics, ¸ÞŸ µ¥ÀÌÅÍ °ËÁõ µî
ÁÖ¿ä ±â´É
(C++ Language Standard) C++11, C++14, C++17, C++20 Áö¿ø
(2nd Code Analysis) SQL µî
(No Compile Step) ÄÚµå ÄÄÆÄÀÏ °úÁ¤ÀÌ ¾ø´Â ¼Ò½º ÄÚµå ºÐ¼®
(Fully Code Assurance)Â÷·®¿ë ÀÓº£µðµå C, C++ ÄÚµå °ËÁõ°ú º¸¾È °¡À̵å ÅëÇÕ Á¡°Ë
(Rule Name) CWE-ID µî Ç¥Áرâ¹Ý One-Guide to One-Rule Á¦°øÀ¸·Î °úŽ¿¹¹æ(¸ÅÇκÒÇÊ¿ä)
(Exception Code Process) ¿¹¿Ü ÄÚµå ÀÚµ¿ µî·Ï ¹× °ü¸®·Î Á¡°Ë½Ã ÀÚµ¿ Á¦¿Ü
(SDLC Chain) Á¤ÀûºÐ¼®µµ±¸°ú Çü»ó°ü¸®½Ã½ºÅÛÀÇ ¿¬µ¿À¸·Î ÄÚµå Á¡°Ë ÀÚµ¿È
(Plug-in) Eclipse, Visual Studio, Jenkins µî ´Ù¼ö
ÁÖ¿ä °í°´
ÀüÀÚ, Á¦Á¶, ÀÚµ¿Â÷ µî ´ë±â¾÷ÀÇ Àü»ç Ç¥ÁØ µµ±¸
Áõ±Ç»çÀÇ Àü»ç Ç¥ÁØ µµ±¸
±¹Ã¥/¹æ»ê/º¸¾È ¿¬±¸¼ÒÀÇ ½Å·Ú¼º/¾ÈÀü¼º/º¸¾È¼º Á¡°ËÀÇ Ç¥ÁØ µµ±¸
|
|
|
|
|