What is Static Analysis?

def process(data):
    if data.type == "A":
        return handle_a(data)
    elif data.type == "B":
        return handle_b(data)
    # What if data.type == "C"? Tests might not cover this.
    # Static analysis sees the uncovered branch.

# Syntactic issues
import os    # unused import - linter catches this
x=1+2        # spacing violation - linter catches this

# Semantic issue: calling undefined function
def main():
    result = proccess_data(x)  # Typo: 'proccess' not defined

# Data flow issue: variable might be None
def get_user(id):
    user = db.find(id)  # Returns User or None
    return user.name    # user might be None!

# Taint issue: user input reaches SQL
user_input = request.args.get("q")  # Source: tainted
query = f"SELECT * FROM t WHERE x = {user_input}"  # Propagation
cursor.execute(query)  # Sink: SQL execution

def dynamic_call(func_name):
    func = getattr(module, func_name)  # Which function? Unknown at static time.
    func()

# Looks unused, but called via framework
@app.route("/users")
def get_users():  # Static analysis might miss the decorator
    return users