amaembo / huntbugs Goto Github PK

Java bytecode static analyzer

License: Apache License 2.0

Java 98.74% XSLT 1.26%

huntbugs's Introduction

This project is abandoned and unlikely will be supported in future

HuntBugs 0.0.11

New Java bytecode static analyzer tool based on Procyon Compiler Tools aimed to supersede the FindBugs. Currently in early development stage, though already could be tried.

Currently 222 FindBugs warnings reimplemented and several new warnings added.

Use with Maven

Compile project and run mvn one.util:huntbugs-maven-plugin:huntbugs

The output report is located in target/huntbugs/report.html

Use with Ant

Build huntbugs-ant-plugin via mvn package (or alternatively download from here)
Take the resulting huntbugs-ant-plugin-<version>-nodeps.jar
Define the task:

<taskdef resource="one/util/huntbugs/ant/antlib.xml">
    <classpath path="path/to/huntbugs-ant-plugin-<version>-nodeps.jar"/>
</taskdef>

Run it:

<huntbugs classPath="${MY_APP_CLASSPATH}" 
          auxClassPath="${DEPS_CLASSPATH}" 
          html="path/to/html/report.html" 
          xml="path/to/xml/report.xml"/>

Use with Gradle

Check the Gradle plugin page

Use with Eclipse

Check the Eclipse plugin page (in early development stage)

Exec as command-line tool

Command-line tool is mostly aimed to aid developers. Nevertheless you may use it if you like. To launch use mvn exec:java -Dexec.args="...args..." inside huntbugs subdirectory. Examples:

mvn exec:java -Dexec.args="-lw" will list all the warnings.
mvn exec:java -Dexec.args="myfolder/*.jar" will analyze all jars inside myfolder writing the report into huntbugs.warnings.xml and huntbugs.warnings.html in current directory.
mvn exec:java will show all the supported command line options.

huntbugs's People

Contributors

Stargazers

Watchers

huntbugs's Issues

FP: Unsupported method call

The BoundedLocalCache.lazySetMaximum() is unsupported.
This code calls BoundedLocalCache.lazySetMaximum(). However analysis found that
this method as well as and its overrides (if applicable) unconditionally throw
UnsupportedOperationException, so it's likely that this call will fail.

The base class throws an UOE and code generated subclasses override as needed. The exceptions are never thrown due to the method only being called if the feature was supported (and therefore overridden).

False positive "redundant null check" in try-with-resources epilogue

Apparently every try-with-resources generates a warning.

Maven plugin: aggregate results for submodules

In multi-module maven project it's desired to analyze all the subprojects at once.

FP: Private method is never called

The method CaffeineConfiguration.$deserializeLambda$() is private and never called.
The private method CaffeineConfiguration.$deserializeLambda$() is never explicitly called
and probably should be removed. If it's designed to be called via reflection or via method
handles API, it's a good practice to annotate it by some annotation which will explicitly
signal that the method is necessary.

Seems to not recognize Java serialization yet. Unfortunately required due to the JSR's interface.

FP: Local variable is assigned to a value which is never used

This code assigns a new value to the local variable field and this value is never
used subsequently. Probably something else was meant or the assignment could be removed.

This one is odd because the field is used in the happy path.

Field field = null;
try {
  // try OpenJDK field name
  field = Unsafe.class.getDeclaredField(openJdk);
} catch (NoSuchFieldException e) {
  try {
    // try Android field name...
  } catch (NoSuchFieldException e2) {
    // try to create a new instance...
  }
  field.setAccessible(true);
  return (Unsafe) field.get(null);
}

Question: is there any plan to release newer version?

Hi,

We use pom dependencies and need the fix "HuntBugsMojo: art.getType() checked" to be released.

Do you think you could release current version 0.0.10 (before 0.1.0 which might take more time) in observable future? :)

Add checkstyle or similar to enforce code style

At least simple checks: curly brace location, tabs vs spaces, import order, white space at EOL

FP: Unsupported method call (2)

The Map.put() is unsupported.
This code calls Map.put(). However analysis found that this method as well as 
and its overrides (if applicable) unconditionally throw UnsupportedOperationException,
so it's likely that this call will fail.

This makes little sense to me as it is calling into a HashMap. It must be observing that AbstractMap#put() throws an UOE but the subclass does not.

Map<K, V> result = new HashMap<>(loaded.size());
loaded.forEach((key, value) -> {
  if ((key == null) || (value == null)) {
    nullBulkLoad.set(true);
  } else {
    result.put(key, value);
  }
});

Error: LocalVariableTableEntry throw IAE

Class:	com/github/benmanes/caffeine/cache/LocalCache
java.lang.IllegalArgumentException: Argument 'type' cannot be null.
	at com.strobel.core.VerifyArgument.notNull(VerifyArgument.java:37)
	at com.strobel.assembler.ir.attributes.LocalVariableTableEntry.<init>(LocalVariableTableEntry.java:41)
	at com.strobel.assembler.ir.MetadataReader.readAttributeCore(MetadataReader.java:180)
	at com.strobel.assembler.metadata.ClassFileReader.readAttributeCore(ClassFileReader.java:260)
	at com.strobel.assembler.ir.MetadataReader.readAttribute(MetadataReader.java:50)
	at com.strobel.assembler.ir.MetadataReader.readAttributes(MetadataReader.java:40)
	at com.strobel.assembler.metadata.ClassFileReader.readAttributeCore(ClassFileReader.java:202)
	at com.strobel.assembler.ir.MetadataReader.inflateAttribute(MetadataReader.java:368)
	at com.strobel.assembler.ir.MetadataReader.inflateAttributes(MetadataReader.java:345)
	at com.strobel.assembler.metadata.ClassFileReader.defineMethods(ClassFileReader.java:977)
	at com.strobel.assembler.metadata.ClassFileReader.readClass(ClassFileReader.java:440)
	at com.strobel.assembler.metadata.ClassFileReader.readClass(ClassFileReader.java:365)
	at com.strobel.assembler.metadata.MetadataSystem.resolveType(MetadataSystem.java:124)
	at one.util.huntbugs.analysis.Context$2.resolveType(Context.java:191)
	at com.strobel.assembler.metadata.MetadataSystem.resolveCore(MetadataSystem.java:76)
	at com.strobel.assembler.metadata.MetadataResolver.resolve(MetadataResolver.java:104)
	at com.strobel.assembler.metadata.CoreMetadataFactory$UnresolvedGenericType.resolve(CoreMetadataFactory.java:742)
	at one.util.huntbugs.util.Types.isInstance(Types.java:97)
	at one.util.huntbugs.util.Types.isInstance(Types.java:101)
	at one.util.huntbugs.util.Types.isCollection(Types.java:176)
	at one.util.huntbugs.util.Methods.isSideEffectFree(Methods.java:210)
	at one.util.huntbugs.db.MethodStats.visitBody(MethodStats.java:126)
	at one.util.huntbugs.db.MethodStats.visitMethod(MethodStats.java:100)
	at one.util.huntbugs.db.MethodStats.visitType(MethodStats.java:78)
	at one.util.huntbugs.registry.DatabaseRegistry.visitType(DatabaseRegistry.java:66)
	at one.util.huntbugs.registry.DetectorRegistry.populateDatabases(DetectorRegistry.java:192)
	at one.util.huntbugs.analysis.Context.preparingClasses(Context.java:151)
	at one.util.huntbugs.analysis.Context.analyzePackage(Context.java:120)
	at one.util.huntbugs.gradle.HuntBugsTask.tryToStartAnalyse(HuntBugsTask.groovy:129)
	at one.util.huntbugs.gradle.HuntBugsTask.runAnalysis(HuntBugsTask.groovy:93)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:73)
	at org.gradle.api.internal.project.taskfactory.DefaultTaskClassInfoStore$StandardTaskAction.doExecute(DefaultTaskClassInfoStore.java:141)
	at org.gradle.api.internal.project.taskfactory.DefaultTaskClassInfoStore$StandardTaskAction.execute(DefaultTaskClassInfoStore.java:134)
	at org.gradle.api.internal.project.taskfactory.DefaultTaskClassInfoStore$StandardTaskAction.execute(DefaultTaskClassInfoStore.java:123)
	at org.gradle.api.internal.AbstractTask$TaskActionWrapper.execute(AbstractTask.java:624)
	at org.gradle.api.internal.AbstractTask$TaskActionWrapper.execute(AbstractTask.java:607)
	at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeAction(ExecuteActionsTaskExecuter.java:95)
	at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeActions(ExecuteActionsTaskExecuter.java:76)
	at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.execute(ExecuteActionsTaskExecuter.java:55)
	at org.gradle.api.internal.tasks.execution.SkipUpToDateTaskExecuter.execute(SkipUpToDateTaskExecuter.java:61)
	at org.gradle.api.internal.tasks.execution.ValidatingTaskExecuter.execute(ValidatingTaskExecuter.java:58)
	at org.gradle.api.internal.tasks.execution.SkipEmptySourceFilesTaskExecuter.execute(SkipEmptySourceFilesTaskExecuter.java:88)
	at org.gradle.api.internal.tasks.execution.ResolveTaskArtifactStateTaskExecuter.execute(ResolveTaskArtifactStateTaskExecuter.java:45)
	at org.gradle.api.internal.tasks.execution.SkipTaskWithNoActionsExecuter.execute(SkipTaskWithNoActionsExecuter.java:51)
	at org.gradle.api.internal.tasks.execution.SkipOnlyIfTaskExecuter.execute(SkipOnlyIfTaskExecuter.java:54)
	at org.gradle.api.internal.tasks.execution.ExecuteAtMostOnceTaskExecuter.execute(ExecuteAtMostOnceTaskExecuter.java:43)
	at org.gradle.api.internal.tasks.execution.CatchExceptionTaskExecuter.execute(CatchExceptionTaskExecuter.java:34)
	at org.gradle.execution.taskgraph.DefaultTaskGraphExecuter$EventFiringTaskWorker.execute(DefaultTaskGraphExecuter.java:233)
	at org.gradle.execution.taskgraph.DefaultTaskGraphExecuter$EventFiringTaskWorker.execute(DefaultTaskGraphExecuter.java:215)
	at org.gradle.execution.taskgraph.AbstractTaskPlanExecutor$TaskExecutorWorker.processTask(AbstractTaskPlanExecutor.java:74)
	at org.gradle.execution.taskgraph.AbstractTaskPlanExecutor$TaskExecutorWorker.run(AbstractTaskPlanExecutor.java:55)
	at org.gradle.execution.taskgraph.DefaultTaskPlanExecutor.process(DefaultTaskPlanExecutor.java:32)
	at org.gradle.execution.taskgraph.DefaultTaskGraphExecuter.execute(DefaultTaskGraphExecuter.java:113)
	at org.gradle.execution.SelectedTaskExecutionAction.execute(SelectedTaskExecutionAction.java:37)
	at org.gradle.execution.DefaultBuildExecuter.execute(DefaultBuildExecuter.java:37)
	at org.gradle.execution.DefaultBuildExecuter.access$000(DefaultBuildExecuter.java:23)
	at org.gradle.execution.DefaultBuildExecuter$1.proceed(DefaultBuildExecuter.java:43)
	at org.gradle.execution.DryRunBuildExecutionAction.execute(DryRunBuildExecutionAction.java:32)
	at org.gradle.execution.DefaultBuildExecuter.execute(DefaultBuildExecuter.java:37)
	at org.gradle.execution.DefaultBuildExecuter.execute(DefaultBuildExecuter.java:30)
	at org.gradle.initialization.DefaultGradleLauncher$4.run(DefaultGradleLauncher.java:197)
	at org.gradle.internal.Factories$1.create(Factories.java:25)
	at org.gradle.internal.progress.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:91)
	at org.gradle.internal.progress.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:53)
	at org.gradle.initialization.DefaultGradleLauncher.doBuildStages(DefaultGradleLauncher.java:194)
	at org.gradle.initialization.DefaultGradleLauncher.access$200(DefaultGradleLauncher.java:36)
	at org.gradle.initialization.DefaultGradleLauncher$1.create(DefaultGradleLauncher.java:118)
	at org.gradle.initialization.DefaultGradleLauncher$1.create(DefaultGradleLauncher.java:112)
	at org.gradle.internal.progress.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:91)
	at org.gradle.internal.progress.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:63)
	at org.gradle.initialization.DefaultGradleLauncher.doBuild(DefaultGradleLauncher.java:112)
	at org.gradle.initialization.DefaultGradleLauncher.run(DefaultGradleLauncher.java:98)
	at org.gradle.launcher.exec.GradleBuildController.run(GradleBuildController.java:66)
	at org.gradle.tooling.internal.provider.ExecuteBuildActionRunner.run(ExecuteBuildActionRunner.java:28)
	at org.gradle.launcher.exec.ChainingBuildActionRunner.run(ChainingBuildActionRunner.java:35)
	at org.gradle.launcher.exec.InProcessBuildActionExecuter.execute(InProcessBuildActionExecuter.java:41)
	at org.gradle.launcher.exec.InProcessBuildActionExecuter.execute(InProcessBuildActionExecuter.java:26)
	at org.gradle.tooling.internal.provider.ContinuousBuildActionExecuter.execute(ContinuousBuildActionExecuter.java:75)
	at org.gradle.tooling.internal.provider.ContinuousBuildActionExecuter.execute(ContinuousBuildActionExecuter.java:49)
	at org.gradle.tooling.internal.provider.ServicesSetupBuildActionExecuter.execute(ServicesSetupBuildActionExecuter.java:44)
	at org.gradle.tooling.internal.provider.ServicesSetupBuildActionExecuter.execute(ServicesSetupBuildActionExecuter.java:29)
	at org.gradle.launcher.daemon.server.exec.ExecuteBuild.doBuild(ExecuteBuild.java:67)
	at org.gradle.launcher.daemon.server.exec.BuildCommandOnly.execute(BuildCommandOnly.java:36)
	at org.gradle.launcher.daemon.server.api.DaemonCommandExecution.proceed(DaemonCommandExecution.java:120)
	at org.gradle.launcher.daemon.server.exec.WatchForDisconnection.execute(WatchForDisconnection.java:47)
	at org.gradle.launcher.daemon.server.api.DaemonCommandExecution.proceed(DaemonCommandExecution.java:120)
	at org.gradle.launcher.daemon.server.exec.ResetDeprecationLogger.execute(ResetDeprecationLogger.java:26)
	at org.gradle.launcher.daemon.server.api.DaemonCommandExecution.proceed(DaemonCommandExecution.java:120)
	at org.gradle.launcher.daemon.server.exec.RequestStopIfSingleUsedDaemon.execute(RequestStopIfSingleUsedDaemon.java:34)
	at org.gradle.launcher.daemon.server.api.DaemonCommandExecution.proceed(DaemonCommandExecution.java:120)
	at org.gradle.launcher.daemon.server.exec.ForwardClientInput$2.call(ForwardClientInput.java:74)
	at org.gradle.launcher.daemon.server.exec.ForwardClientInput$2.call(ForwardClientInput.java:72)
	at org.gradle.util.Swapper.swap(Swapper.java:38)
	at org.gradle.launcher.daemon.server.exec.ForwardClientInput.execute(ForwardClientInput.java:72)
	at org.gradle.launcher.daemon.server.api.DaemonCommandExecution.proceed(DaemonCommandExecution.java:120)
	at org.gradle.launcher.daemon.server.exec.LogAndCheckHealth.execute(LogAndCheckHealth.java:55)
	at org.gradle.launcher.daemon.server.api.DaemonCommandExecution.proceed(DaemonCommandExecution.java:120)
	at org.gradle.launcher.daemon.server.exec.LogToClient.doBuild(LogToClient.java:60)
	at org.gradle.launcher.daemon.server.exec.BuildCommandOnly.execute(BuildCommandOnly.java:36)
	at org.gradle.launcher.daemon.server.api.DaemonCommandExecution.proceed(DaemonCommandExecution.java:120)
	at org.gradle.launcher.daemon.server.exec.EstablishBuildEnvironment.doBuild(EstablishBuildEnvironment.java:72)
	at org.gradle.launcher.daemon.server.exec.BuildCommandOnly.execute(BuildCommandOnly.java:36)
	at org.gradle.launcher.daemon.server.api.DaemonCommandExecution.proceed(DaemonCommandExecution.java:120)
	at org.gradle.launcher.daemon.server.exec.StartBuildOrRespondWithBusy$1.run(StartBuildOrRespondWithBusy.java:50)
	at org.gradle.launcher.daemon.server.DaemonStateCoordinator$1.run(DaemonStateCoordinator.java:293)
	at org.gradle.internal.concurrent.ExecutorPolicy$CatchAndRecordFailures.onExecute(ExecutorPolicy.java:54)
	at org.gradle.internal.concurrent.StoppableExecutorImpl$1.run(StoppableExecutorImpl.java:40)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at java.lang.Thread.run(Thread.java:745)

Add Travis CI job

FP: Local variable now is never used

Local variable now is never used.
This code contains a local variable now which is assigned but never used.
Probably it could be removed.

This variable is used within a lambda expression,

long now = cache.expirationTicker().read();
Consumer<Node<K, V>> consumer = node -> {
  K key = node.getKey();
  V value = node.getValue();
  if ((key != null) && (value != null) && !cache.hasExpired(node, now) && node.isAlive()) {
    action.accept(new WriteThroughEntry<>(cache, key, value));
    advanced[0] = true;
  }
};

Respect @SuppressWarnings("all")

FP: Possible null dereference

Possible null dereference in CaffeineSpec.parseDuration().
The expression value.length() may fail with NullPointerException as value
can be null at this location.

static long parseDuration(String key, String value) {
  requireArgument(value != null && !value.isEmpty(), "value of key %s omitted", key);
  return parseLong(key, value.substring(0, value.length() - 1));
}

where requireArgument is defined as,

static void requireArgument(boolean expression, String template, Object... args) {
  if (!expression) {
    throw new IllegalArgumentException(String.format(template, args));
  }
}

Resulting in a null check prior to value.length() so that it will never throw a NPE.

Mojo: type defined in pom.xml dependency (of pom type) is not resolved

If in pom.xml you have dependency of pom type, then those types are not resolved. I.e.
TypeDefinition td = typeReference.resolve(); // td = null;

(Replacing pom type dependency to regular jar dependency solves the issue)

feature suggestion: import "find security bugs" from findbugs into this project

FP: Useless void method

The method SingleConsumerQueue.LinearizableNode.await() seems to do nothing useful.
Analysis discovers that void method SingleConsumerQueue.LinearizableNode.await() has non-trivial body, yet does nothing useful. Probably there's some mistake.

This is a spin loop watching a volatile field. This would be true if the field was non-volatile, as the JVM could optimize it away as dead code. The volatile introduces a load barrier so that the signal is observed.

volatile boolean done;

void await() {
  while (!done) {}
}

sergei-rudenkov@EPBYMINW4306:~/IdeaProjects/spring_training/theatre_service$ mvn -e one.util:huntbugs-maven-plugin:huntbugs
+ Error stacktraces are turned on.
[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] Building Spring Core Hometask Skeleton
[INFO]    task-segment: [one.util:huntbugs-maven-plugin:huntbugs]
[INFO] ------------------------------------------------------------------------
[INFO] [huntbugs:huntbugs {execution: default-cli}]
[INFO] HuntBugs: +dir /home/sergei-rudenkov/IdeaProjects/spring_training/theatre_service/target/classes
[INFO] ------------------------------------------------------------------------
[ERROR] BUILD ERROR
[INFO] ------------------------------------------------------------------------
[INFO] Failed to run HuntBugs

[INFO] ------------------------------------------------------------------------
[INFO] Trace
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to run HuntBugs
    at org.apache.maven.lifecycle.DefaultLifecycleExecutor.executeGoals(DefaultLifecycleExecutor.java:719)
    at org.apache.maven.lifecycle.DefaultLifecycleExecutor.executeStandaloneGoal(DefaultLifecycleExecutor.java:569)
    at org.apache.maven.lifecycle.DefaultLifecycleExecutor.executeGoal(DefaultLifecycleExecutor.java:539)
    at org.apache.maven.lifecycle.DefaultLifecycleExecutor.executeGoalAndHandleFailures(DefaultLifecycleExecutor.java:387)
    at org.apache.maven.lifecycle.DefaultLifecycleExecutor.executeTaskSegments(DefaultLifecycleExecutor.java:348)
    at org.apache.maven.lifecycle.DefaultLifecycleExecutor.execute(DefaultLifecycleExecutor.java:180)
    at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:328)
    at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:138)
    at org.apache.maven.cli.MavenCli.main(MavenCli.java:362)
    at org.apache.maven.cli.compat.CompatibleMain.main(CompatibleMain.java:60)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.codehaus.classworlds.Launcher.launchEnhanced(Launcher.java:315)
    at org.codehaus.classworlds.Launcher.launch(Launcher.java:255)
    at org.codehaus.classworlds.Launcher.mainWithExitCode(Launcher.java:430)
    at org.codehaus.classworlds.Launcher.main(Launcher.java:375)
Caused by: org.apache.maven.plugin.MojoExecutionException: Failed to run HuntBugs
    at one.util.huntbugs.maven.plugin.HuntBugsMojo.execute(HuntBugsMojo.java:100)
    at org.apache.maven.plugin.DefaultPluginManager.executeMojo(DefaultPluginManager.java:490)
    at org.apache.maven.lifecycle.DefaultLifecycleExecutor.executeGoals(DefaultLifecycleExecutor.java:694)
    ... 17 more
Caused by: java.lang.NullPointerException
    at one.util.huntbugs.maven.plugin.HuntBugsMojo.constructRepository(HuntBugsMojo.java:114)
    at one.util.huntbugs.maven.plugin.HuntBugsMojo.execute(HuntBugsMojo.java:91)
    ... 19 more
[INFO] ------------------------------------------------------------------------
[INFO] Total time: < 1 second
[INFO] Finished at: Fri May 27 17:59:45 MSK 2016
[INFO] Final Memory: 8M/150M
[INFO] ------------------------------------------------------------------------

Could you please point me out what is can be wrong with my project?