Many sources note that automatic static code analysis include data flow and control flow. But these two are included in white box testing as well. Is there a difference in the automation? That in automatic static analysis all is done by the tools while in white box testing, a person creates the data to exercise the possible paths?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Static analysis and testing are different things, and pick up different classes of problems.
With black or white box testing, you execute parts of the code with inputs, etc that the developer or tester thinks are important. The only real quality control you have over the developer / tester's design of test cases is code coverage ... and that doesn't tell you anything about whether the logic has been properly tested.
By contrast, static analysis is looking for problems in a different way; i.e. by analysing what the code does independently of the test cases / data. Typically they find different kinds of problem, and typically they find them with less effort on the part of the developer / tester. For example, a static analyser might identify dead code, or a storage or resource leak that would be impossible to find by unit testing, or an unsafe practice like (in Java) using
In short the two approaches are complementary.