FindBugs

버그 잡기. 프로그램 분석 도구를 이용하자.

 

FindBugs

http://findbugs.sourceforge.net/bugDescriptions.html

    <plugin>
           <groupId>org.codehaus.mojo</groupId>
           <artifactId>findbugs-maven-plugin</artifactId>
           <version>1.2</version>
           <configuration>
              <findbugsXmlOutput>true</findbugsXmlOutput>
              <findbugsXmlWithMessages>true</findbugsXmlWithMessages>
          <xmlOutput>true</xmlOutput>
          <excludeFilterFile>${basedir}/findBugsExclude.xml</excludeFilterFile>         
           </configuration>
    </plugin>

 

<FindBugsFilter>
    <Match>
          <Bug code="Se,SnVI,Dm" />
    </Match>
</FindBugsFilter>

http://findbugs.sourceforge.net/manual/filter.html

http://mojo.codehaus.org/findbugs-maven-plugin/findbugs-mojo.html

 

강연

Sun Techdays 2008 Lightning Talk 발표자료; findbugs

http://developers.sun.com/learning/javaoneonline/2007/pdf/TS-2007.pdf

 

10분36초. Joshua Bloch

http://www.buggymind.com/177

If Josh makes a dumb mistake, you are allowed to make a dumb mistake, all right?

 

//Eclipse 3.0.0M8

String sig = type.getSignature();

if(sig!=null || sig.length() ==1 ) {

   return sig;

}

 

Eclipse 3.0.0M8

String name = workingCopy.getName()

name.replace('/','.);

 

비교

 

http://stackoverflow.com/questions/207652/how-do-commercial-java-static-analysis-tools-compare-with-the-free-ones

 

So it depends on whether your priority is quality checking (Findbugs, Coverity) or security vulnerability analysis (Klocwork, or Fortify).