Feeds

Finding bugs with FindBugs

But we never write poor code, do we?

Internet Security Threat Report 2014

A good compiler does more than simply refuse to compile syntactically incorrect code. Most modern compilers can issue warnings about many different types of potential problem, from reporting on the use of deprecated libraries and packages, to sounding alarm bells about uninitialised variables, or ignoring return values from functions or methods.

But, as useful as a compiler can be in flagging potential bugs, it can only go so far. For many developers, what lies beyond the compiler is the unit testing framework and a barrage of tests.

However, there's a class of development tool that can also be used to root out bugs before they happen, and that's a static code analysis tool. In contrast to dynamic analysis, which involves looking at code that's running, static analysis focuses on source or object code (byte code in the Java world).

One such tool is FindBugs, which analyses Java byte code to flag potential errors. Originally developed by Bill Pugh at the University of Maryland, FindBugs is released as open source software (under the Lesser GPL licence), and has been supported by Fortify Software, Google, Sun and others.

It works by looking for common "bug idioms", in other words it searches through byte code looking to do some fancy pattern matching against a database of dodgy code. Some of this unsafe code is down to poorly understood APIs, difficult language features, misunderstood invariants or just down to plain old poor coding (it does happen...).

The software is available in a number of formats - as a standalone jar file, as a Java web start version, and as an Eclipse plug-in. There's even a version available for NetBeans, though it's unofficial and not supported by the FindBugs team.

The Eclipse version is straightforward to install. It's a simple case of using the native Eclipse software updates wizard to point to the correct URL and letting it do the rest.

In contrast to some plug-ins there are few dependencies and the process is incredibly smooth. Once installed the functionality slots in very nicely with the rest of Eclipse, for example, problems discovered by FindBugs are flagged in the normal Problems window rather than creating a separate display.

Because FindBugs uses static analysis of byte code it's not really the sort of tool that is used interactively (unlike Eclipse's incremental compiler), in other words it doesn't flag problems as you type in your source code. However, right-clicking on a package or class in the Package Explorer and selecting "Find Bugs" from the menu triggers the analysis, which dumps the warnings to the Problems display. Clicking on a problem then highlights the offending code in the editor window, and right-clicking offers more details on the type of error.

Each of the error types that the "Find Bugs" process reports is tagged with a code, and this can be used both to find out more about that error and also to enable or disable it. In Eclipse it's a simple case of looking at Project properties, clicking on FindBugs and then selecting/deselecting the list error types. Additional configuration options include a severity setting, so that you can decide just how strict (or how masochistic) you want to be.

The standalone version of the software (either the jar file or the web start version), features a rather plain GUI that hides similar functionality to the Eclipse version. Once a project has been defined - by pointing the tool in the direction of your source and class files - it's a case of hitting the analyse button and letting it do its stuff. A tabbed display is used to show problems listed by class, package, error type or error category. This is useful as it allows the developer to hone in on specific categories of potential bugs, such as malicious code, vulnerabilities, or performance hits. Whichever view is used, clicking on a bug shows details of the type of error and the offending bit of code. And, of course, the types of errors you want found is fully configurable.

In practice both the standalone and the Eclipse versions of FindBugs have different virtues. Being embedded in an IDE has advantages in that it's easy to go in and fix errors once they've been identified (though there's no quick-fix support as there are with the simpler types of errors that the Eclipse compiler finds). On the other hand, the standalone version provides a useful categorised display which can help in deciding which problems you want tackled first. In either case both versions provide real value to a developer.

One problem that is common to static analysis tools is raising too many false alarms. In practice FindBugs errs on the side of caution compared to some tools. This is generally a good thing, a tool that flags too many inconsequential issues or too many false alarms is likely to be ignored or quietly ditched. FindBugs, however, is worth sticking with. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
Sway: Microsoft's new Office app doesn't have an Undo function
Content aggregation, meet the workplace ... oh
Sign off my IT project or I’ll PHONE your MUM
Honestly, it’s a piece of piss
Return of the Jedi – Apache reclaims web server crown
.london, .hamburg and .公司 - that's .com in Chinese - storm the web server charts
NetWare sales revive in China thanks to that man Snowden
If it ain't Microsoft, it's in fashion behind the Great Firewall
Chrome 38's new HTML tag support makes fatties FIT and SKINNIER
First browser to protect networks' bandwith using official spec
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.