Feeds

Finding bugs with FindBugs

But we never write poor code, do we?

Top 5 reasons to deploy VMware with Tegile

A good compiler does more than simply refuse to compile syntactically incorrect code. Most modern compilers can issue warnings about many different types of potential problem, from reporting on the use of deprecated libraries and packages, to sounding alarm bells about uninitialised variables, or ignoring return values from functions or methods.

But, as useful as a compiler can be in flagging potential bugs, it can only go so far. For many developers, what lies beyond the compiler is the unit testing framework and a barrage of tests.

However, there's a class of development tool that can also be used to root out bugs before they happen, and that's a static code analysis tool. In contrast to dynamic analysis, which involves looking at code that's running, static analysis focuses on source or object code (byte code in the Java world).

One such tool is FindBugs, which analyses Java byte code to flag potential errors. Originally developed by Bill Pugh at the University of Maryland, FindBugs is released as open source software (under the Lesser GPL licence), and has been supported by Fortify Software, Google, Sun and others.

It works by looking for common "bug idioms", in other words it searches through byte code looking to do some fancy pattern matching against a database of dodgy code. Some of this unsafe code is down to poorly understood APIs, difficult language features, misunderstood invariants or just down to plain old poor coding (it does happen...).

The software is available in a number of formats - as a standalone jar file, as a Java web start version, and as an Eclipse plug-in. There's even a version available for NetBeans, though it's unofficial and not supported by the FindBugs team.

The Eclipse version is straightforward to install. It's a simple case of using the native Eclipse software updates wizard to point to the correct URL and letting it do the rest.

In contrast to some plug-ins there are few dependencies and the process is incredibly smooth. Once installed the functionality slots in very nicely with the rest of Eclipse, for example, problems discovered by FindBugs are flagged in the normal Problems window rather than creating a separate display.

Because FindBugs uses static analysis of byte code it's not really the sort of tool that is used interactively (unlike Eclipse's incremental compiler), in other words it doesn't flag problems as you type in your source code. However, right-clicking on a package or class in the Package Explorer and selecting "Find Bugs" from the menu triggers the analysis, which dumps the warnings to the Problems display. Clicking on a problem then highlights the offending code in the editor window, and right-clicking offers more details on the type of error.

Each of the error types that the "Find Bugs" process reports is tagged with a code, and this can be used both to find out more about that error and also to enable or disable it. In Eclipse it's a simple case of looking at Project properties, clicking on FindBugs and then selecting/deselecting the list error types. Additional configuration options include a severity setting, so that you can decide just how strict (or how masochistic) you want to be.

The standalone version of the software (either the jar file or the web start version), features a rather plain GUI that hides similar functionality to the Eclipse version. Once a project has been defined - by pointing the tool in the direction of your source and class files - it's a case of hitting the analyse button and letting it do its stuff. A tabbed display is used to show problems listed by class, package, error type or error category. This is useful as it allows the developer to hone in on specific categories of potential bugs, such as malicious code, vulnerabilities, or performance hits. Whichever view is used, clicking on a bug shows details of the type of error and the offending bit of code. And, of course, the types of errors you want found is fully configurable.

In practice both the standalone and the Eclipse versions of FindBugs have different virtues. Being embedded in an IDE has advantages in that it's easy to go in and fix errors once they've been identified (though there's no quick-fix support as there are with the simpler types of errors that the Eclipse compiler finds). On the other hand, the standalone version provides a useful categorised display which can help in deciding which problems you want tackled first. In either case both versions provide real value to a developer.

One problem that is common to static analysis tools is raising too many false alarms. In practice FindBugs errs on the side of caution compared to some tools. This is generally a good thing, a tool that flags too many inconsequential issues or too many false alarms is likely to be ignored or quietly ditched. FindBugs, however, is worth sticking with. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
Preview redux: Microsoft ships new Windows 10 build with 7,000 changes
Latest bleeding-edge bits borrow Action Center from Windows Phone
Google opens Inbox – email for people too thick to handle email
Print this article out and give it to someone tech-y if you get stuck
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Redmond top man Satya Nadella: 'Microsoft LOVES Linux'
Open-source 'love' fairly runneth over at cloud event
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.