1.什么是findbug？

FindBugs 是一个静态分析工具，它检查类或者 JAR 文件，将字节码与一组缺陷模式进行对比以发现可能的问题。有了静态分析工具，就可以在不实际运行程序的情况对软件进行分析。不是通过分析类文件的形式或结构来确定程序的意图，而是通常使用 Visitor 模式来鉴别代码是否符合一些固定的规范。

2.代码工程

实验目的

通过findbug发现程序中存在的问题

pom.xml

通过mvn package执行findbug check命令

<?xml version="1.0" encoding="UTF-8"?><project xmlns="http://maven.apache.org/POM/4.0.0"         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">    <parent>        <artifactId>springboot-demo</artifactId>        <groupId>com.et</groupId>        <version>1.0-SNAPSHOT</version>    </parent>    <modelVersion>4.0.0</modelVersion>
    <artifactId>findbug</artifactId>
    <properties>        <maven.compiler.source>8</maven.compiler.source>        <maven.compiler.target>8</maven.compiler.target>    </properties>    <dependencies>
        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-web</artifactId>        </dependency>
        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-autoconfigure</artifactId>        </dependency>        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-test</artifactId>            <scope>test</scope>        </dependency>

    </dependencies>    <build>    <!-- findbugs插件 -->    <plugins>
        <plugin>            <groupId>org.codehaus.mojo</groupId>            <artifactId>findbugs-maven-plugin</artifactId>            <version>3.0.5</version>            <configuration>                <!-- 设置分析工作的等级，可以为Min、Default和Max -->                <effort>Low</effort>                <!-- Low、Medium和High (Low最严格) High只扫描严重错误。建议用Medium-->                <threshold>Medium</threshold>                <failOnError>true</failOnError>                <includeTests>true</includeTests>                <!--findbugs需要忽略的错误的配置文件-->                <excludeFilterFile>conf/findbugs-exclude-filter.xml</excludeFilterFile>            </configuration>            <executions>                <execution>                    <id>run-findbugs</id>                    <!-- 在package(也可设为compile) 阶段触发执行findbugs检查，比如执行 mvn clean package -->                    <phase>package</phase>                    <goals>                        <goal>check</goal>                    </goals>                </execution>            </executions>        </plugin>    </plugins></build>
        </project>

模拟错误

package com.et.findbug;
/** * @author liuhaihua * @version 1.0 * @ClassName MockError * @Description todo * @date 2024/06/25/ 17:30 */
public class MockError {    private static String dbrBO;    public final void refresh() {        dbrBO = null;    }}

忽略检测


<?xml version="1.0" encoding="UTF-8"?><FindBugsFilter>    <Match>        <Class name="com.et.findbug.MockError" />    </Match>    <Match>        <Package name="com.et.findbug.controller" />    </Match>    <Match>        <Class name="com.et.findbug.controller" />        <Method name="showHelloWorld"></Method>    </Match>    <Match>        <!--装箱后拆箱紧接着装箱，忽略不处理 -->        <!-- Boxed value is unboxed and then immediately reboxed-->        <Package name="~.*" />        <Bug pattern="BX_UNBOXING_IMMEDIATELY_REBOXED" />    </Match>
</FindBugsFilter>

手工模拟一些错误

package com.et.findbug;
import java.text.DateFormat;import java.text.SimpleDateFormat;import java.util.Date;import java.util.Map;import java.util.Random;
public class FindBugsDemo {
    private static final DateFormat yyyyMMdd = new SimpleDateFormat("yyyy-MM-dd");
    public static String yyyyMMddForMat(Date date) {        return yyyyMMdd.format(date);    }
    public static int getRanDom() {        return new Random().nextInt();    }
    public static int round(int num) {        return Math.round(num);    }
    public static void printMap(Map<?, ?> map) {        if (map != null && map.size() > 0) {            for (Object key : map.keySet()) {                System.out.println("key--->" + key);                System.out.println("value--->" + map.get(key));            }        }    }
    public static String trimString(String str) {        str.trim();        return str;    }
    @Override    public boolean equals(Object obj) {        return super.equals(obj);    }
}

以上只是一些关键代码，所有代码请参见下面代码仓库

代码仓库

https://github.com/Harries/springboot-demo

3.测试

执行打包命令

mvn package

返回结果

[INFO] [INFO] --- findbugs-maven-plugin:3.0.5:check (run-findbugs) @ findbug ---[INFO] BugInstance size is 3[INFO] Error size is 0[INFO] Total bugs: 3[INFO] Random object created and used only once in com.et.findbug.FindBugsDemo.getRanDom() [com.et.findbug.FindBugsDemo] At FindBugsDemo.java:[line 18] DMI_RANDOM_USED_ONLY_ONCE[INFO] int value cast to float and then passed to Math.round in com.et.findbug.FindBugsDemo.round(int) [com.et.findbug.FindBugsDemo] At FindBugsDemo.java:[line 22] ICAST_INT_CAST_TO_FLOAT_PASSED_TO_ROUND[INFO] com.et.findbug.FindBugsDemo.printMap(Map) makes inefficient use of keySet iterator instead of entrySet iterator [com.et.findbug.FindBugsDemo] At FindBugsDemo.java:[line 29] WMI_WRONG_MAP_ITERATOR[INFO] To see bug detail using the Findbugs GUI, use the following command "mvn findbugs:gui"

4.引用

suorceforge 地址：http://findbugs.sourceforge.net/
官方的文档：http://findbugs.sourceforge.net/manual
http://www.liuhaihua.cn/archives/710780.html

ITPub博客

Spring Boot集成findbug快速入门Demo