findbugs

Hudson's FindBugs plugin reports line number "-1" for bugs. Ideas?

Greetings, I have a simple test project set up in Hudson and the project's build process (a batch file) generates a findbugs.xml file. This is processed by Hudson's FindBugs plugin but it shows the line number of the bugs as "-1" instead of their actual line number. A coworker suggested I enable debug info for the compiler. I used th...

How can I generate a FindBugs report that shows me the bugs removed between two revisions in the bug database?

I am attempting to execute a combination of the FindBugs commands filterBugs and convertXmlToText, against a bug database that I created, to generate a report that shows me the all of the bugs removed between two revisions of the system that I am working on. Unfortunately, the resulting report does not show any bug details. It appears ...

What does these FindBug messages show?

Not every description from from http://findbugs.sourceforge.net/bugDescriptions.html is clear to me. Sure, I can study the implementation but if somebody is more experienced then me, some explanation and examples would be great. Do you have some examples for UI_INHERITANCE_UNSAFE_GETRESOURCE when this is getting a problem? In BX_UNBOXE...

What does all these FindBugs prefixes AM, BC, DP, ... mean?

http://findbugs.sourceforge.net/bugDescriptions.html contains a long list of error types. They belong to a category like correctness and performance but do start with an prefix too. EQ for equality is obvious, same like SQL or BIT. But some cryptic. Is there a list what all these prefixes mean? ...

Method may fail to close stream on exception

I get the critical error with finbugs The method creates an IO stream object, does not assign it to any fields, pass it to other methods, or return it, and does not appear to close it on all possible exception paths out of the method. This may result in a file descriptor leak. It is generally a good idea to use a finally block to ensu...

Delegating Struts action class management to Spring raises MTIA critical voilation in Findbugs

When i use "Delegate Struts Action management to Spring" approach explained in http://www.ibm.com/developerworks/java/library/j-sr2.html#N101B7 things work fine in terms of functionality but findbugs reports following voilation Dodgy - Class extends Struts Action class and uses instance variables:MTIA I have bean dependencies injected...

Discover NullPointerException bugs using FindBug

When I run FindBug on this code, it reports NO issues. boolean _closed = false; public void m1(@Nullable String text) { if(_closed) return; System.out.println(text.toLowerCase()); } While here it finds issue as expected: public void m1(@Nullable String text) { System.out.println(text.toLowerCase()); // FindBugs...

What is the proper way to use a Logger in a Serializable Java class?

I have the following (doctored) class in a system I'm working on and Findbugs is generating a SE_BAD_FIELD warning and I'm trying to understand why it would say that before I fix it in the way that I thought I would. The reason I'm confused is because the description would seem to indicate that I had used no other non-serializable insta...

Adding exclusive filter for <static initializer> in findbugs

Hi all, I want my findbugs report not show the following error: DM_NUMBER_CTOR: Method invokes inefficient Number constructor; use static valueOf instead The problem is that this happens in groovy-generated code files, so I can't control the source code - that is why I want to exclude it and add it to my exclude filter. I do not want...

When to stop following the advice of static code analysis?

I do use static code analysis on a project with more than 100.000 lines of Java code for quite a while now. I started with Findbugs, which gave me around 1500 issues at the beginning. I fixed the most severe over time and started using additional tools like PMD, Lint4J, JNorm and now Enerjy. With the more severe issues being fixed, ther...

Filter for jar-file by analyse with findbugs

Hi, I have a jar-file, which I want analyze with findbugs through build.xml. I use "class location =....jar" - pattern. The jar-file contains several folders, but I need to analyze only one folder. How can I specify that ? Thanks in advance ! ...

Findbugs and comparing

I recently started using the findbugs static analysis tool in a java build I was doing. The first report came back with loads of High Priority warnings. Being the obsessive type of person, I was ready to go knock them all out. However, I must be missing something. I get most of the warnings when comparing things. Such as the followi...

How to integrate findbugs with maven

Please provide steps to integrate findbugs with maven ...

maven findbugs 'high water mark'

[findbugs is the example here, question is applicable to any such maven plugin] I attended a build lecture not long ago and a pattern that was talked about that I quite liked was: when adding a new tool to the chain and you start with n violations, you should keep n decreasing (a high water mark) and fail the build only when current che...

findbugs and database password security issue

I'm using the following code to initialize database connection: public Connection getConnection() { try { if (null == connection) { String driverName = "com.mysql.jdbc.Driver"; // MySQL MM JDBC driver Class.forName(driverName); // Create a connection to the database ...

FindBugs: How can I run it in Java 5 mode?

When I run FindBugs on my project via Maven, I get lots of these: Can't use annotations when running in JDK 1.4 mode! How do I fix that? Couldn't find anything in the manual. ...

Findbugs "Method May Fail to Close Stream" when using getResourceAsStream

Hi If I have the following code in a servlet: Properties p = new Properties(); p.load(getClass().getResourceAsStream("/test.properties")); If I run the servlet through FindBugs, I would expect to get the warning OS_OPEN_STREAM, but I don't. If I use a similar approach to open an arbitrary file on the filesystem (ie not in the classpa...

Can I tell findbugs to ignore classes I am unable to add?

Findbugs reports this: findbugs: [findbugs] Executing findbugs from ant task [findbugs] Running FindBugs... [findbugs] The following classes needed for analysis were missing: [findbugs] com.company.OptionalClass [findbugs] Warnings generated: 11 [findbugs] Missing classes: 2 [findbugs] Calculating exit code... [findbugs] Setti...

Using custom detectors with FindBugs Maven plugin

I have a nice JAR of some custom FindBugs detectors I'd like to use with the FindBugs Maven plugin. There is a way to do this with the plugin via the <pluginList> configuration parameter, but that only accepts local files, URLs, or resources. The only way I found for doing so is to somehow copy my JAR to a local file (maybe via the Depe...

Which version of FindBugs can run on Java 1.4?

I want to run FindBugs on a project, but we're still stuck with Java 1.4 (and I won't go political now... :-}). The latest version of FindBugs can only run on JRE 1.5+, so I'm wondering which version was the last to support 1.4? Update FindBugs v1.2.1 is running on Java 1.4. ...