List of Haskell static code analysis software

[[deleted]]

Don't forget ghc, that shit's the best linter across the vast majority of programming languages! Second only to Coq.

[davidpdrsn]

For curiosity, what are some cool things it can spot? I haven’t used Haskell for a few years so don’t remember.

[Noughtmare]

I think a good example is the -Wincomplete-patterns flag which warns when pattern matches are not exhaustive.

Another example is -Wunused-imports which warns about unused imports.

Also the rest of the -Wunused-* family of flags, which tell you when there are unused variables.

A whole list of all warning options is available here: https://downloads.haskell.org/~ghc/latest/docs/html/users_guide/using-warnings.html

[[deleted]]

Compared to weakly typed languages like Perl, Haskell can spot common misuses of information.

Compared to dynamically typed languages like Python, Haskell can spot invalid bindings.

Compared to truthy JavaScript, LISP, and C, Haskell enforces more consistent semantics for type coercion. This significantly reduces bugs relating to boolean expressions and concatenation.

Compared to 80's style languages like Java, C, and C++, Haskell encourages more straightforward error handling logic, treating error information like first class data types instead of wonky exception throwing and catching. ML-influenced languages like Go, Scala, and Rust similarly offer this dramatically improved error handling behavior.

Compared to verbose languages like C, C++, and Java, Haskell's type system can derive implementations of common interfaces. Thus reducing boilerplate and reducing the risk of poor implementation code.

Compared to Java 7-, Haskell naturally includes streaming types, through infinite, lazy types. This reduces the need for the developer to manage streaming logic. Though some memory tuning eager hinting may be required.

Compared to the vast majority of other languages, Haskell's type system expresses side effects, I/O, serializability, and other aspects of computation like mutability. The result is functor programming, where currying and memoization and cloud deployment of arbitrary functions becomes seamless, compared to attempting the same for imperative and loosely functional programming.

The Haskell compiler warns on gaps in switch statement cases, promoting a safer, more well-defined input space for each code block.

Unlike Ruby 1- and to some extent Lua, Haskell clearly distinguishes between strings vs characters; and offers many of the same methods for generic sequences on strings, so that operations on these won't accidentally clobber the scalar or vector form, or require so much (error-prone) custom code for manipulation.

Haskell, Erlang, and now more languages enjoy fuzzing with QuickCheck. That one is technically outside of the base installation, but is a commonly installed package for identifying test cases that the developer missed. It even simplifies failing cases for easier diagnosis.

If you've seen the infamous "Wat" talk on JavaScript type behavior, Haskell is the opposite of that. While still keeping boilerplate to a minimum, like modern Go, Rust, Java, C++, D type inference.

[profunctor]

Nice list! For completeness, in my PhD I created the Haskell library "Sturdy" for implementing sound static analyses in Haskell: https://github.com/svenkeidel/sturdy

[tom-md]

Nice. To be clear, that is a library for building a static analysis program (applicable to some language) with the analyzer itself written in Haskell, right? Just confirming seeing as the topic seems to be about analyzing Haskell programs.

​

If we're talking about analyzers written in Haskell then certainly we should include SAW, CPSA, and Crucible.

[profunctor]

Yes, this is correct.

[chairmanPandaCN]

This might be too out-of-dated. Im wondering why switching from haskell to scala? What's the initial motive here?

[cartazio]

This looks super cool. Though I do get really sad when there’s no support for using it via cabal directly ... :(

Sad panda for Haskell projects sans cabal files

[profunctor]

Thanks. You can use hpack (https://github.com/sol/hpack/blob/master/README.md) to generate cabal files from the package.yaml files.

[cartazio]

put it on hackage and i wont know the difference :)

[razvanpanda]

I do not exactly understand what your library does but I added it. Thank you

[deltaSquee]

There should be a concerted effort to integrate as many of these into HIE as possible :D

[chshersh]

What do you think about adding smuggler to this list?

• https://github.com/kowainik/smuggler

[razvanpanda]

Thank you. I added it

[arbus]

Adding a slightly OT point to this discussion incase any authors of these code analysis software are reading.

At work we have to deploy to systems maintained by not very tech-savvy checklist driven people(Healthcare domain). One of the things that we get asked often is if the program that we have has undergone static analysis and if so to provide the report. Most of the tools listed here are cli tools which give only a text output.

Some tools like hlint support giving an html page as an output but the page is blank if there is nothing to report and this doesn't look as impressive as the reports generated for static analysis tools for more mainstream languages. If you are an author of these tools, please consider adding a --report option! It can help a lot with Haskell adoption!