Robust Software
Code Reviews
A code review is the examination of source code by another programmer or by an automated tool, looking for errors, vulnerabilities and poor practice. It happens before the software is released, so problems are found and fixed while they are still easy to put right, and the suggestions a review produces raise the quality of the code.
Reviewing by hand or by tool
| Method | Strength | Drawback |
|---|---|---|
| A programmer reads the code | The reviewer understands what the code is meant to do, so they can question the whole approach, asking for example why a quiz game keeps every player's password as ordinary text, and suggest a safer structure. Judgement of that kind is beyond a rule-following tool. | Someone has to be found and taken away from their own work, so the release can slip, and a tired reader can skim past a fault. Spotting a flaw in the design also takes experience that a newer member of the team may not have. |
| An automated tool checks the code | It sweeps through every file in seconds and applies the same rules each time, so a banned command or a familiar bad pattern is flagged at once, and the result does not depend on the mood of the person checking. | It has no idea what the code is for. It reacts only to the patterns built into its rule set, so it catches the well-known problems it was built to look for and stays silent about everything else. |
Finding a weakness is not the same as removing it. Until validation or exception handling is added, the program still cannot cope with unexpected or incorrect input, so a review moves software towards being robust rather than making it so on its own.