COSCUP 2023

Flutter 不再黑箱之Dart語言源碼檢測分享
2023-07-29, 10:50–11:20 (Asia/Taipei), TR 312
Language: Traditional Chinese (Taiwan)

Flutter 是一個由 Google 開發的跨平台應用程式開發框架,讓開發者可以使用一套程式碼開發 iOS、Android、Web 和桌面應用程式。SonarQube 是著名開源程式碼檢測工具。隨著應用程式規模的不斷擴大,程式碼品質和安全性的重要性也日益凸顯,程式碼靜態掃描是安全程式開發工作第一步.本演講將介紹如何使用SonarQube來進行Flutter程式的靜態程式分析,以確保程式品質和可維護性。我們將深入探討SonarQube的工作原理以及如何配置SonarQube來掃描Flutter程式。此外,我們還會講解SonarQube如何提供即時反饋,並生成報告和指示,幫助開發團隊識別和解決潛在的程式問題。

Flutter is a cross-platform application development framework developed by Google, allowing developers to use a single codebase to develop applications for iOS, Android, Web, and desktop. SonarQube is a well-known open-source code analysis tool. As the scale of applications continues to expand, the importance of code quality and security becomes increasingly prominent, and static code scanning is the first step in secure software development. This talk will introduce how to use SonarQube for static code analysis of Flutter applications to ensure code quality and maintainability. We will delve into the working principles of SonarQube and how to configure it for scanning Flutter code. Additionally, we will discuss how SonarQube provides real-time feedback and generates reports and guidelines to help development teams identify and address potential code issues.


Flutter是一種先進的跨平台開發框架,讓開發人員能夠快速開發高品質的行動應用和網絡應用。然而,為了確保程式品質和可維護性,需要進行靜態程式分析。SonarQube是一個廣泛使用的開源平台,它可以通過分析程式,對程式品質進行靜態分析,並生成報告和指示。

在這個演講中,我們將介紹如何使用SonarQube來掃描Flutter程式,並提供有關程式品質和可維護性的寶貴信息。這包括程式複雜性、重複、覆蓋率、風格和其他程式品質指標。通過SonarQube,開發人員可以更好地理解他們的程式,並更快速地解決潛在的程式問題。

此外,我們還會介紹如何配置SonarQube來掃描Flutter程式,以及如何設置SonarQube以提供即時反饋。SonarQube不僅可以在每次程式提交時自動運行,還可以生成報告,幫助開發團隊更好地管理程式質量。最後,我們還會討論SonarQube的限制以及如何解決常見的問題。

總之,本演講將讓我們帶領觀眾深入了解如何使用SonarQube來提高Flutter程式的品質和可維護性,以便開發高品質的應用程式。

Flutter is an advanced cross-platform development framework that enables developers to rapidly create high-quality mobile and web applications. However, to ensure code quality and maintainability, static code analysis is necessary. SonarQube is a widely used open-source platform that performs static analysis of code to assess its quality and generates reports and guidelines.

In this presentation, we will demonstrate how to use SonarQube to scan Flutter code and provide valuable insights into code quality and maintainability. This includes metrics such as code complexity, duplication, coverage, style, and other code quality indicators. With SonarQube, developers can gain a better understanding of their codebase and swiftly address potential code issues.

Furthermore, we will cover the configuration of SonarQube for scanning Flutter code and setting up real-time feedback. SonarQube can automatically run on every code submission and generate reports to assist development teams in better managing code quality. Lastly, we will discuss limitations of SonarQube and strategies to tackle common challenges.

In summary, this presentation will provide valuable insights into leveraging SonarQube to enhance code quality and maintainability in Flutter applications, enabling the development of high-quality applications.


Difficulty

入門

Target Audience

使用Flutter的開發者、對靜態源碼檢測有興趣

各位大家好,我叫沈宜婷,可以叫我noflag,專攻資訊安全,體制外學生,跳脫現今教育制度,是一位致力在資安圈打拼的女性

研究項目:車聯網資安、應用程式安全、機器學習

github : https://github.com/Trinity-SYT-SECURITY

☞中華資安國際 SOC team,實習生

☞NCKU 金融資安實驗室,行動應用程式資安檢測人員

☞Google Developer Group (GDG) Taichung Organizer

This speaker also appears in:

曾任數家金融機構之開發者/資安工程師/資安主管,其專長於雲端資安規劃,零信任架構,混合環境資安監控及數據驅動資安,亦為 GDG Taipei (台北谷歌技術社群) 資安領域負責人