Professional Code Reviews - Bogdan Gusiev

CODE REVIEW PROCESSCODE REVIEW PROCESS
BOGDAN GUSIEVBOGDAN GUSIEV

CODE REVIEW TENDS TO BE NATURALCODE REVIEW TENDS TO BE NATURAL

CODE REVIEW YOURSELFCODE REVIEW YOURSELF

ASKING FOR HELPASKING FOR HELP

SPONDANUOUS CODE REVIEW PROBLEM:SPONDANUOUS CODE REVIEW PROBLEM:
TOO LATETOO LATE

EVERYTHING HAD CHANGED BYEVERYTHING HAD CHANGED BY
GITHUBGITHUB

DO I NEED A CODE REVIEW?DO I NEED A CODE REVIEW?
IMHO: NEW PROJECTSIMHO: NEW PROJECTS
DON'T NEED A FORMAL CODE REVIEW AT ALLDON'T NEED A FORMAL CODE REVIEW AT ALL

CODE REVIEW EVOLUTIONCODE REVIEW EVOLUTION
1. Spontanuous Code Reviews
2. "When I am not sure" code reviews
3. Formal Code Review Process
4. Required code review for certain changes
5. Required code reviews for everything
Fails Driven Process

CODE REVIEW PROPERTIESCODE REVIEW PROPERTIES
NECESSITYNECESSITY
Optional
Required
PROCESSPROCESS
Informal
Formal
PEOPLEPEOPLE
Dedicated
Distributed

POSITION IN A PROCESSPOSITION IN A PROCESS
1. Planning
2. Coding
3. Code Review
4. QA
5. Release
QA <-> Code Review
Formally QA a er Code Review

1. Make a fork (optional)
2. Create a Branch
3. Open a Pull Request
4. Wait for review
5. Discuss & Fix
6. Merge

CODE REVIEW ISCODE REVIEW IS
A PROCESS OFA PROCESS OF REVIEWING AND APPROVINGREVIEWING AND APPROVING CODE CHANGESCODE CHANGES
BEFOREBEFORE THEY GET ACCEPTED TO THE MAINSTREAMTHEY GET ACCEPTED TO THE MAINSTREAM

FIX COMMON THINGS FIRST?FIX COMMON THINGS FIRST?
Typos
Whitespace
Code Style
Wrong Direction!

WHERE TO LOOK?WHERE TO LOOK?
Things that are most significant should be reviewed first
which are ones that are the most hard to change.

TOP TO BOTTOM CODE REVIEWTOP TO BOTTOM CODE REVIEW
1. Architecture
1. Problem Solution
2. Public APIs
3. Database Schema
4. Object Oriented Design
5. Public Method Signatures
2. Implementation
1. Classes & Methods
2. Views
3. Tests
4. Code Style, Typos, Whitespace

PROBLEM SOLUTIONPROBLEM SOLUTION
1. Problem makes sense
2. Problem Solved
3. High Level Security
4. High Level Performance

ONLY SHOW CUSTOM PROPERTIES WITH AT LEAST ONE VALUE IN SELECTONLY SHOW CUSTOM PROPERTIES WITH AT LEAST ONE VALUE IN SELECT
def selectable_product_categories
+ ProductCategory.with_at_least_one_product
- ProductCategory.all
end
ProductCategory.
where("not exists(select * from products where ...)").
count # => 0

HIGH LEVEL SECURITYHIGH LEVEL SECURITY
EX. FEATURE:EX. FEATURE:
LOGIN USER AUTOMATICALLY WHEN IT CLICKS ON THE LINK IN THE EMAILLOGIN USER AUTOMATICALLY WHEN IT CLICKS ON THE LINK IN THE EMAIL
THIS IS NOT VERY SECURETHIS IS NOT VERY SECURE

HIGH LEVEL PERFORMANCEHIGH LEVEL PERFORMANCE
CHECK IF THE CHANGECHECK IF THE CHANGE
Touches Performance sensitive code
Will be slow for particular data
No pagination when there are 1000+ records to display

PUBLIC APISPUBLIC APIS
USING HTTP API AS EXAMPLEUSING HTTP API AS EXAMPLE
1. Eﬀiciency
2. Logical Endpoints
3. Request Parameters
4. Response Format
WHATEVER THAT IS DOCUMENTEDWHATEVER THAT IS DOCUMENTED

API INEFFICIENCY EXAMPLEAPI INEFFICIENCY EXAMPLE
EFFICIENT WAY?EFFICIENT WAY?
Purchase.has_one :referral
GET /purchases/:order_number
{
id: 1,
order_number: '1838382',
referral_id: 17
}
POST /referrals/:id/approve
POST /purchases/:order_number/referral/approve

RESPONSE FORMATRESPONSE FORMAT
# Easier
render json: @campaign.view_setups.to_json
# Extensible
render json: {view_setups: @campaign.view_setups.to_json}

BAD API EXAMPLEBAD API EXAMPLE
Talkable.publish('talkable_offer_close', null, true);
Talkable.publish('offer_close', null, true);

ANALYZE USAGE FIRSTANALYZE USAGE FIRST
BUT NOT IMPLEMENTATIONBUT NOT IMPLEMENTATION
setCustomProperty: function (person, properties) {
...
}
setCustomProperty('advocate', {key: value})
setCustomProperty('friend', {key: value})
setAdvocateCustomProperty: function(properties) {
private_stuff.setCustomProperty("advocate", properties);
},
setFriendCustomProperty: function(properties) {
private_stuff.setCustomProperty("friend", properties);
},

DATABASE SCHEMADATABASE SCHEMA
1. Relations between tables
2. Data Columns
3. Naming

EFFICIENT RELATIONSEFFICIENT RELATIONS
1. What are the variants?
2. Was the best one selected?

EFFICIENT SCHEMAEFFICIENT SCHEMA
add_column :images, :dimension, :string
class Image < AR::Base
def width
dimension.split("x").first
end
def height
dimension.split("x").last
end
end
add_column :images, :width, :integer
add_column :images, :height, :integer

DATA SHOULD BEDATA SHOULD BE EASY TO READEASY TO READ
EVEN IF IT MAKES ITEVEN IF IT MAKES IT HARDER TO WRITEHARDER TO WRITE

OBJECT ORIENTED DESIGNOBJECT ORIENTED DESIGN
1. Reflects Real World
2. Inheritance
3. Constructors

REVIEWING CONSTRUCTORSREVIEWING CONSTRUCTORS
CIRCULAR DEPENDENCYCIRCULAR DEPENDENCY
class Field
def initialize
@cells = Array.new(10) do
Array.new(10) { Cell.new(self) }
end
end
end
class Cell
def initialize(field)
@field = field
end
end

OBJECT CONSTRUCTORS ARE IMPORTANT:OBJECT CONSTRUCTORS ARE IMPORTANT:
Which things are required to use an object?
What are the object responsibilities?
Theoretical limit
Which methods can be implemented in the object?
Which things would need to be passed to methods as arguments?
Constructor defines object API

REVIEWING CONSTRUCTORSREVIEWING CONSTRUCTORS
UNDEFINED CONTEXTUNDEFINED CONTEXT
class ApplicationController
before_action do
WhateverRequestAnalyzer.new(request).analyze
end
end
CrawlerRequestAnalyzer.new(
request.user_agent, request.url, request.content_type
).analyze

PUBLIC METHOD SIGNATURESPUBLIC METHOD SIGNATURES
1. Placement
2. Arguments
3. Name

METHOD PLACEMENTMETHOD PLACEMENT
class User
def approve!(referral)
end
# OR
class Referral
def approve!(user)
end

METHOD ARGUMENTSMETHOD ARGUMENTS
this.extractUserData(this.data)

CLASSES & METHOD BODIESCLASSES & METHOD BODIES
Each method or class separately
Check one by one:
1. Approach & Algorithm
2. Performance
3. Security
4. Minimalism
5. Local Variable Names

PERFORMANCE & VULNERABILITIESPERFORMANCE & VULNERABILITIES
In the ideal world performance and vulnerabilities
should not change the code structure.
In practice it can but we should try hard
to fix performance problems only at the implementation level

GOOD PERFORMANCE PATCHGOOD PERFORMANCE PATCH
def core_options
- { header: name, description: description, group: group }
+ @core_options ||= { header: name, description: description, grou
end
- @campaign.locale_entries.each do
+ @campaign.locale_entries.preload(:variants).each do

GOOD VULNERABILITY PATCHGOOD VULNERABILITY PATCH
-{{ advocate_info.first_name }}
+{{ advocate_info.first_name | escape }}

SECURITYSECURITY
Approach Security (Step 1)
Is it secure to have this feature?
Is it secure to implement the feature this way?
Vulnerabilities
XSS
Allowed Parameters
Backend Authorisation check
Authorisation for UI elements

TESTSTESTS
1. Use Cases Coverage
2. Formal Code Coverage
3. Tests Implementation

TOP TO BOTTOM IDEATOP TO BOTTOM IDEA
IT IS BAD TO:IT IS BAD TO:
Discuss the method name before the method existence as a fact
Discuss Code Style before implementation itself

BOSS CONTROL APPROACHBOSS CONTROL APPROACH
Ensure top points from the list are always performed
Choose X things on top of the list to double-check and delegate the rest
completely

CODE REVIEW CULTURECODE REVIEW CULTURE
Be Polite
Admit good things
First things first
Reduce number of cycles
Save Author's time
Save Your time

TOP TO BOTTOM CODE REVIEWTOP TO BOTTOM CODE REVIEW
1. Architecture
1. Problem Solution
2. Public APIs
3. Database Schema
4. Object Oriented Design
5. Public Method Signatures
2. Implementation
1. Classes & Methods
2. Views
3. Test Coverage
4. Code Style, Typos, Whitespace

Professional Code Reviews - Bogdan Gusiev

More Related Content

What's hot (20)

Similar to Professional Code Reviews - Bogdan Gusiev (20)

More from Ruby Meditation (20)

Recently uploaded (20)

Professional Code Reviews - Bogdan Gusiev