Checkmate, developers: IntelliJ IDEA plugin catches copy-pasted Java code
(2022/01/05)
- Reference: 1641367632
- News link: https://www.theregister.co.uk/2022/01/05/intellij_code_copying/
- Source link:
Boffins affiliated with dev tools biz JetBrains and HSE University in Moscow have devised an open-source plugin for the company's Java development editor that guards against copy-and-paste coding.
AntiCopyPaster, [1]available on GitHub , works with IntelliJ IDEA, JetBrain's integrated development environment (IDE) for Java programmers. It was created by Anton Ivanov, Zarina Kurbatova, Yaroslav Golubev, Andrey Kirilenko, Timofey Bryksin to help mitigate the problems that can accompany copied code.
In [2]a paper posted to ArXiv, the researchers observe that while "[c]opying and pasting constitute an essential part of writing programming code," doing so can lead to code maintenance, security problems, and licensing issues.
[3]
"While there is nothing wrong with the copying and pasting as such, research also shows that having clones inside a project can make its maintenance more difficult due to overgrown codebases," the paper explains. "Fixing vulnerabilities across multiple duplicate instances can be difficult and lead to increased security risks."
[4]
[5]
Software licensing problems are also a possibility. A [6]2020 paper by some of the same researchers looked at code cloning in 24,000 Java projects on GitHub and found that almost 10 per cent of copied code blocks potentially violate their original licenses.
[7]We've only gone and got our hands on an early preview of Fleet, the forthcoming JetBrains IDE
[8]All change at JetBrains: Remote development now, new IDE previewed
[9]Does the world need another cross-platform framework? Tough, here's JetBrains with Compose Multiplatform
[10]JavaScript, GitHub, AWS crowned winners in massive survey of 32,000 developers
There is a lot of duplicate code floating around due to developers' inclination toward [11]copypasta . As of 2017, [12]about 70 per cent of the code on GitHub came from copied files. The enduring attraction of copied code has given rise to [13]a faux book titled "Copying and Pasting from Stack Overflow" and t-shirts bearing that same copy.
AntiCopyPaster attempts to deal with copypasta by monitoring the IDE for pasted code. It scans the Java methods within the destination file to find duplicates.
The plugin does so by trimming away spaces and checking to see whether each method's body contains the code snippet as a substring. If it doesn't find a match, it goes further by tokenizing the code and looking for substantial similarities.
[14]
But it also tries not to hector developers unnecessarily – the plugin tries not to intrude by waiting a user-set amount of time after a paste operation to allow the copied code to be edited. Only if the cloned code is left unaltered does the plugin then move on to checking whether the pasted fragment is Java code and whether it's correctly constructed.
If so, AntiCopyPaster will run the snippet through its onboard Gradient Boosting Classifier model to check whether it's a suitable candidate for refactoring (revision) using IntelliJ IDEA's built-in [15]Extract Method . This involves removing a subset of statements from a method and creating new methods to be called in their place.
Developers who do so should end up with more manageable code and at least have a chance to catch potential problems in the original snippet.
[16]
The authors note that the AntiCopyPaster pipeline can be extended to look for other code imperfections.
"Overall, we hope that AntiCopyPaster can help developers maintain the quality of their projects by combating the propagation of code clones," the boffins' paper concludes. "We also hope that our research can inspire further work in the area." ®
Get our [17]Tech Resources
[1] https://github.com/JetBrains-Research/anti-copy-paster
[2] https://arxiv.org/abs/2112.15230
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://arxiv.org/abs/2002.05237
[7] https://www.theregister.com/2021/12/09/hands_on_jetbrains_fleet/
[8] https://www.theregister.com/2021/11/29/jetbrains_fleet_ide/
[9] https://www.theregister.com/2021/08/06/compose_for_desktop_kotlin_framework/
[10] https://www.theregister.com/2021/07/16/jetbrains_developer_survey_2021/
[11] https://en.wikipedia.org/w/index.php?title=Copypasta&oldid=1059416049
[12] https://www.theregister.com/2017/11/21/github_duplicate_code/
[13] https://www.goodreads.com/en/book/show/29437996-copying-and-pasting-from-stack-overflow
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://www.jetbrains.com/help/idea/extract-method.html#8c370a71
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://whitepapers.theregister.com/
AntiCopyPaster, [1]available on GitHub , works with IntelliJ IDEA, JetBrain's integrated development environment (IDE) for Java programmers. It was created by Anton Ivanov, Zarina Kurbatova, Yaroslav Golubev, Andrey Kirilenko, Timofey Bryksin to help mitigate the problems that can accompany copied code.
In [2]a paper posted to ArXiv, the researchers observe that while "[c]opying and pasting constitute an essential part of writing programming code," doing so can lead to code maintenance, security problems, and licensing issues.
[3]
"While there is nothing wrong with the copying and pasting as such, research also shows that having clones inside a project can make its maintenance more difficult due to overgrown codebases," the paper explains. "Fixing vulnerabilities across multiple duplicate instances can be difficult and lead to increased security risks."
[4]
[5]
Software licensing problems are also a possibility. A [6]2020 paper by some of the same researchers looked at code cloning in 24,000 Java projects on GitHub and found that almost 10 per cent of copied code blocks potentially violate their original licenses.
[7]We've only gone and got our hands on an early preview of Fleet, the forthcoming JetBrains IDE
[8]All change at JetBrains: Remote development now, new IDE previewed
[9]Does the world need another cross-platform framework? Tough, here's JetBrains with Compose Multiplatform
[10]JavaScript, GitHub, AWS crowned winners in massive survey of 32,000 developers
There is a lot of duplicate code floating around due to developers' inclination toward [11]copypasta . As of 2017, [12]about 70 per cent of the code on GitHub came from copied files. The enduring attraction of copied code has given rise to [13]a faux book titled "Copying and Pasting from Stack Overflow" and t-shirts bearing that same copy.
AntiCopyPaster attempts to deal with copypasta by monitoring the IDE for pasted code. It scans the Java methods within the destination file to find duplicates.
The plugin does so by trimming away spaces and checking to see whether each method's body contains the code snippet as a substring. If it doesn't find a match, it goes further by tokenizing the code and looking for substantial similarities.
[14]
But it also tries not to hector developers unnecessarily – the plugin tries not to intrude by waiting a user-set amount of time after a paste operation to allow the copied code to be edited. Only if the cloned code is left unaltered does the plugin then move on to checking whether the pasted fragment is Java code and whether it's correctly constructed.
If so, AntiCopyPaster will run the snippet through its onboard Gradient Boosting Classifier model to check whether it's a suitable candidate for refactoring (revision) using IntelliJ IDEA's built-in [15]Extract Method . This involves removing a subset of statements from a method and creating new methods to be called in their place.
Developers who do so should end up with more manageable code and at least have a chance to catch potential problems in the original snippet.
[16]
The authors note that the AntiCopyPaster pipeline can be extended to look for other code imperfections.
"Overall, we hope that AntiCopyPaster can help developers maintain the quality of their projects by combating the propagation of code clones," the boffins' paper concludes. "We also hope that our research can inspire further work in the area." ®
Get our [17]Tech Resources
[1] https://github.com/JetBrains-Research/anti-copy-paster
[2] https://arxiv.org/abs/2112.15230
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://arxiv.org/abs/2002.05237
[7] https://www.theregister.com/2021/12/09/hands_on_jetbrains_fleet/
[8] https://www.theregister.com/2021/11/29/jetbrains_fleet_ide/
[9] https://www.theregister.com/2021/08/06/compose_for_desktop_kotlin_framework/
[10] https://www.theregister.com/2021/07/16/jetbrains_developer_survey_2021/
[11] https://en.wikipedia.org/w/index.php?title=Copypasta&oldid=1059416049
[12] https://www.theregister.com/2017/11/21/github_duplicate_code/
[13] https://www.goodreads.com/en/book/show/29437996-copying-and-pasting-from-stack-overflow
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://www.jetbrains.com/help/idea/extract-method.html#8c370a71
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YdV6WKqQhDZq8KthKB40CAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://whitepapers.theregister.com/
Joe W
mark it as a security issue refuse to paste it
(though we all have been guilty of this...)
Contradictions
_LC_
Why does it feel like someone here is always stumbling on the same contradiction: on the one hand, you want compliant, inexpensive dogs that will follow along obediently with everything. On the other hand, these stupid dogs just don't get it done.
False positives?
tiggity
If lots of "work" being done in a method then huge amounts of scope to code it in a large variety of ways
If a method is doing a well defined, relatively small piece of "work" (as they hopefully should be) then far fewer (reasonable) ways to code the functionality, and many of the ways will be variations on a theme to a human observer.
So, does this tool ignore small and simple methods and only look at bloaty code? as if it looks at small methods it could erroneously report a false positive purely because when there's only a small number of ways to do something then your code may be very similar to someone else's code (coding version of convergent evolution)
Improvement
He's a suggestion for an improvement - and it's simpler too:
Has the code been copied from Stackoverflow? If so, mark it as a security issue.