Feeds

Finding bugs with FindBugs

But we never write poor code, do we?

Security and trust: The backbone of doing business over the internet

A good compiler does more than simply refuse to compile syntactically incorrect code. Most modern compilers can issue warnings about many different types of potential problem, from reporting on the use of deprecated libraries and packages, to sounding alarm bells about uninitialised variables, or ignoring return values from functions or methods.

But, as useful as a compiler can be in flagging potential bugs, it can only go so far. For many developers, what lies beyond the compiler is the unit testing framework and a barrage of tests.

However, there's a class of development tool that can also be used to root out bugs before they happen, and that's a static code analysis tool. In contrast to dynamic analysis, which involves looking at code that's running, static analysis focuses on source or object code (byte code in the Java world).

One such tool is FindBugs, which analyses Java byte code to flag potential errors. Originally developed by Bill Pugh at the University of Maryland, FindBugs is released as open source software (under the Lesser GPL licence), and has been supported by Fortify Software, Google, Sun and others.

It works by looking for common "bug idioms", in other words it searches through byte code looking to do some fancy pattern matching against a database of dodgy code. Some of this unsafe code is down to poorly understood APIs, difficult language features, misunderstood invariants or just down to plain old poor coding (it does happen...).

The software is available in a number of formats - as a standalone jar file, as a Java web start version, and as an Eclipse plug-in. There's even a version available for NetBeans, though it's unofficial and not supported by the FindBugs team.

The Eclipse version is straightforward to install. It's a simple case of using the native Eclipse software updates wizard to point to the correct URL and letting it do the rest.

In contrast to some plug-ins there are few dependencies and the process is incredibly smooth. Once installed the functionality slots in very nicely with the rest of Eclipse, for example, problems discovered by FindBugs are flagged in the normal Problems window rather than creating a separate display.

Because FindBugs uses static analysis of byte code it's not really the sort of tool that is used interactively (unlike Eclipse's incremental compiler), in other words it doesn't flag problems as you type in your source code. However, right-clicking on a package or class in the Package Explorer and selecting "Find Bugs" from the menu triggers the analysis, which dumps the warnings to the Problems display. Clicking on a problem then highlights the offending code in the editor window, and right-clicking offers more details on the type of error.

Each of the error types that the "Find Bugs" process reports is tagged with a code, and this can be used both to find out more about that error and also to enable or disable it. In Eclipse it's a simple case of looking at Project properties, clicking on FindBugs and then selecting/deselecting the list error types. Additional configuration options include a severity setting, so that you can decide just how strict (or how masochistic) you want to be.

The standalone version of the software (either the jar file or the web start version), features a rather plain GUI that hides similar functionality to the Eclipse version. Once a project has been defined - by pointing the tool in the direction of your source and class files - it's a case of hitting the analyse button and letting it do its stuff. A tabbed display is used to show problems listed by class, package, error type or error category. This is useful as it allows the developer to hone in on specific categories of potential bugs, such as malicious code, vulnerabilities, or performance hits. Whichever view is used, clicking on a bug shows details of the type of error and the offending bit of code. And, of course, the types of errors you want found is fully configurable.

In practice both the standalone and the Eclipse versions of FindBugs have different virtues. Being embedded in an IDE has advantages in that it's easy to go in and fix errors once they've been identified (though there's no quick-fix support as there are with the simpler types of errors that the Eclipse compiler finds). On the other hand, the standalone version provides a useful categorised display which can help in deciding which problems you want tackled first. In either case both versions provide real value to a developer.

One problem that is common to static analysis tools is raising too many false alarms. In practice FindBugs errs on the side of caution compared to some tools. This is generally a good thing, a tool that flags too many inconsequential issues or too many false alarms is likely to be ignored or quietly ditched. FindBugs, however, is worth sticking with. ®

Security and trust: The backbone of doing business over the internet

More from The Register

next story
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.