Feeds

Finding bugs with FindBugs

But we never write poor code, do we?

Beginner's guide to SSL certificates

A good compiler does more than simply refuse to compile syntactically incorrect code. Most modern compilers can issue warnings about many different types of potential problem, from reporting on the use of deprecated libraries and packages, to sounding alarm bells about uninitialised variables, or ignoring return values from functions or methods.

But, as useful as a compiler can be in flagging potential bugs, it can only go so far. For many developers, what lies beyond the compiler is the unit testing framework and a barrage of tests.

However, there's a class of development tool that can also be used to root out bugs before they happen, and that's a static code analysis tool. In contrast to dynamic analysis, which involves looking at code that's running, static analysis focuses on source or object code (byte code in the Java world).

One such tool is FindBugs, which analyses Java byte code to flag potential errors. Originally developed by Bill Pugh at the University of Maryland, FindBugs is released as open source software (under the Lesser GPL licence), and has been supported by Fortify Software, Google, Sun and others.

It works by looking for common "bug idioms", in other words it searches through byte code looking to do some fancy pattern matching against a database of dodgy code. Some of this unsafe code is down to poorly understood APIs, difficult language features, misunderstood invariants or just down to plain old poor coding (it does happen...).

The software is available in a number of formats - as a standalone jar file, as a Java web start version, and as an Eclipse plug-in. There's even a version available for NetBeans, though it's unofficial and not supported by the FindBugs team.

The Eclipse version is straightforward to install. It's a simple case of using the native Eclipse software updates wizard to point to the correct URL and letting it do the rest.

In contrast to some plug-ins there are few dependencies and the process is incredibly smooth. Once installed the functionality slots in very nicely with the rest of Eclipse, for example, problems discovered by FindBugs are flagged in the normal Problems window rather than creating a separate display.

Because FindBugs uses static analysis of byte code it's not really the sort of tool that is used interactively (unlike Eclipse's incremental compiler), in other words it doesn't flag problems as you type in your source code. However, right-clicking on a package or class in the Package Explorer and selecting "Find Bugs" from the menu triggers the analysis, which dumps the warnings to the Problems display. Clicking on a problem then highlights the offending code in the editor window, and right-clicking offers more details on the type of error.

Each of the error types that the "Find Bugs" process reports is tagged with a code, and this can be used both to find out more about that error and also to enable or disable it. In Eclipse it's a simple case of looking at Project properties, clicking on FindBugs and then selecting/deselecting the list error types. Additional configuration options include a severity setting, so that you can decide just how strict (or how masochistic) you want to be.

The standalone version of the software (either the jar file or the web start version), features a rather plain GUI that hides similar functionality to the Eclipse version. Once a project has been defined - by pointing the tool in the direction of your source and class files - it's a case of hitting the analyse button and letting it do its stuff. A tabbed display is used to show problems listed by class, package, error type or error category. This is useful as it allows the developer to hone in on specific categories of potential bugs, such as malicious code, vulnerabilities, or performance hits. Whichever view is used, clicking on a bug shows details of the type of error and the offending bit of code. And, of course, the types of errors you want found is fully configurable.

In practice both the standalone and the Eclipse versions of FindBugs have different virtues. Being embedded in an IDE has advantages in that it's easy to go in and fix errors once they've been identified (though there's no quick-fix support as there are with the simpler types of errors that the Eclipse compiler finds). On the other hand, the standalone version provides a useful categorised display which can help in deciding which problems you want tackled first. In either case both versions provide real value to a developer.

One problem that is common to static analysis tools is raising too many false alarms. In practice FindBugs errs on the side of caution compared to some tools. This is generally a good thing, a tool that flags too many inconsequential issues or too many false alarms is likely to be ignored or quietly ditched. FindBugs, however, is worth sticking with. ®

Beginner's guide to SSL certificates

More from The Register

next story
That dreaded syncing feeling: Will Microsoft EVER fix OneDrive?
Microsoft's long history of broken Windows sync
Mozilla, EFF, Cisco back free-as-in-FREE-BEER SSL cert authority
Let’s Encrypt to give HTTPS-everywhere a boost in 2015
SLURP! Flick your TONGUE around our LOLLIPOP – Google
Android 5 is coming – IF you're lucky enough to have the right gadget
Nokia's N1 fondleslab's HIDDEN BRILLIANCE: The 'Z Launcher'
Sugarcoating Android's Lollipop makes tab easier to swallow
Bug fixes! Get your APPLE BUG FIXES! iOS and OS X updates right here!
Yosemite fixes Wi-Fi hiccup, older iOS devices get performance boost
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
Soz, web devs: Google snatches its Wallet off the table
Killing off web service in 3 months... but app-happy bonkers are fine
Meet Windows 10's new UI for OneDrive – also known as File Explorer
New preview build continues Redmond's retreat to the desktop
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.