Polyglot Code Smell Detection for Infrastructure as Code with GLITCH

This paper presents GLITCH, a new technology-agnostic framework that enables automated polyglot code smell detection for Infrastructure as Code scripts. GLITCH uses an intermediate representation on which different code smell detectors can be defined. It currently supports the detection of nine security smells and nine design & implementation smells in scripts written in Ansible, Chef, Docker, Puppet, or Terraform. Studies conducted with GLITCH not only show that GLITCH can reduce the effort of writing code smell analyses for multiple IaC technologies, but also that it has higher precision and recall than current state-of-the-art tools. A video describing and demonstrating GLITCH is available at: https://youtu.be/E4RhCcZjWbk.

I. Introduction

Infrastructure as Code (IaC) is the process of managing IT infrastructure via programmable configuration files (also called IaC scripts). In recent years, several tools for detecting code smells in IaC scripts have been proposed [1]–[6]. These tools are very valuable, since they cover a wide range of code smells and several major IaC technologies. However, their implementations are separate and involve substantial duplication. If one wishes to implement the detection of a new smell, one has to develop a different implementation for each of the IaC technologies supported. Consequently, it is often the case that the detection of code smells is inconsistent for different IaC technologies. For example, Figure 1 presents a line of code with a comment taken from the project puppet-foreman by The Foreman¹

https://github.com/theforeman/puppet-foreman/blob/1d09876d7838bcd133add6266f4ba19b936ccb6c/manifests/init.pp#L57

. For this example, Schwarz et al.'s tool [2] detects the Long Statement smell because the line has exactly 140 characters, and the tool reports the smell for lines with 140 characters or more. However, if we use the tool Puppeteer [1] to analyze the same line in Puppet, the smell will not be detected since Puppeteer only detects the Long Statement smell for lines with more than 140 characters. Even though this example might be considered a minor problem, it shows that having separate implementations for code smell analysis can easily lead to inconsistent code smell detection. Ensuring consistency is particularly important for projects that use more than one IaC technology.