Oct 29, 2007

FindBugs™ - Find Bugs in Java Programs

http://findbugs.sourceforge.net/

FindBugs™ - Find Bugs in Java Programs

This is the web page for FindBugs, a program which uses static analysis to look for bugs in Java code.  It is free software, distributed under the terms of the Lesser GNU Public License. The name FindBugs™ and the FindBugs logo are trademarked by The University of Maryland. FindBugs is sponsored by Fortify Software and SureLogic. As of May 8th, 2007, FindBugs has been downloaded more than 368,911 times.

FindBugs requires JRE (or JDK) 1.4.0 or later to run.  However, it can analyze programs compiled for any version of Java. The current version of FindBugs is 1.2.1, released on 10:24:29 EDT, 31 May, 2007. We are very interested in getting feedback on how to improve FindBugs.

More | Output | Try | Changes | Talks | Papers | Sponsors | Support

Additional open source projects

The following software is being made available by the University of Maryland and the FindBugs project. The software is still preliminary, and needs volunteers to help mature it.

  • Multithreaded test case, a framework designed to make it easy to create test cases for concurrent software in which multiple threads must coordindate their activity to perform a test (e.g., testing a concurrent blocking queue, with one thread that blocks when it trys to add to a full queue, and another thread that unblocks the first by removing an element).
  • Checked uncontended lock, an implementation of the Java 5 Lock and ReadWriteLock interfaces that throw exceptions if they detect lock contention. These locks are designed to be used for debugging, and can be used in places where you don't believe you need to use a lock but want to verify that at runtime.

Sample output

As an example of the kind of issues FindBugs can identify, we provide our results on the Sun's JDK 7, Eclipse, Netbeans, Glassfish and JBoss. We present these results as a table showing the number of warnings we generate, an html report generated by FindBugs, and using a Java Webstart demo of FindBugs that loads the results of our analysis and the relevant source, so that you can view the source corresponding to each of our warnings and judge for yourself the accuracy of Findbugs.

Briefly, this table gives the number of warnings we found in various applications we use as benchmarks:

Application Details Correctness bugs Bad Practice Dodgy KNCSS
HTML WebStart NP bugs Other
Sun JDK 1.7.0-b12 All All Small 68 180 954 654 597
eclipse-SDK-3.3M7-solaris-gtk All All Small 146 259 1,079 643 1,447
netbeans-6_0-m8 All All Small 189 305 3,010 1,112 1,022
glassfish-v2-b43 All All Small 146 154 964 1,222 2,176
jboss-4.0.5 All All Small 30 57 263 214 178

KNCSS - Thousands of lines of non-commenting source statements

Try FindBugs now on your project!

Using Java Web Start you can try the GUI version of FindBugs now on your project. As long as you have a 1.4 or better JRE installed, you can run FindBugs now. If you are using Java 1.5 or later, you will see the new GUI that we wrote over the summer.

Change history

The current version of FindBugs is s 1.2.1. Changes since version 1.2.1:

  • Bug fixes:
    • Fix bugs in incremental analysis within Eclipse plugin
    • Fix some analysis errors
    • Fix some threading bugs in GUI2
    • Report version as version when it was compiled, not when it was run
    • Copy analysis time stamp when filtering or transforming analysis files.
  • Enabled StaticCalendarDetector
  • Reworked GUI2 to use standard FindBugs filters
    • Allow a suppression filter to be stored in a project and persisted to the XML representation of a project.
  • Move away from old GUI2 save format (a directory containing an xml file and another file containing serialized filters).
  • Supprt/recommend use of two new file extensions/formats:
    .fba - FindBugs Analysis File
    Exactly the same as an existing bug collection file stored in XML format, but using a distinct file extension to make it easier to figure out which xml files contain FindBugs results.
    .fbp - FindBugs Project File
    Contains just the information needed to run FindBugs and display the results (e.g., the files to be analyzed, the auxilary class path and the location of source files)

Older versions...

Talks about FindBugs

Papers about FindBugs

Sponsors

Financial support for the open source FindBugs project is provided by our sponsors, Fortify Software, amd SureLogic,

Fortify Software sells security tools, including Fortify Source Code Analysis, which which uses static analysis to search for security vulnerabilities (much as FindBugs uses static analysis to look for general code quality problems. FindBugs is integrated into Fortify's tools, providing an integrated tool set to look for and audit both security and quality problems (press release).

SureLogic provides a suite of static and dynamic tools designed to find concurrency errors, such as data races and design errors. Starting Fall 2007, SureLogic will provide training, consulting and support for FindBugs on a commercial basis, and will be contributing to the FindBugs open source effort.

Fortify Software now provides Java Open Review, a free analysis and on-line reviewing service to selected open source projects. This provides analysis for both correctness issues identified by FindBugs and security issues (such as SQL injection and Cross-site scripting identified by Fortify's Source Code Analysis, and provides a on-line auditing and commenting facility for contributors of each project. Defect warnings are not visible to the general public, only to contributors of each project. There is a place on the web page where you can request that your project be included in the set of projects reviewed.

Additional Support

YourKit is kindly supporting open source projects with its full-featured Java Profiler. YourKit, LLC is creator of innovative and intelligent tools for profiling Java and .NET applications. Take a look at YourKit's leading software products: YourKit Java Profiler and YourKit .NET Profiler.

Additional financial support for the FindBugs project has been provided by Google, Sun Microsystems, National Science Foundation grants ASC9720199 and CCR-0098162, and by a 2004 IBM Eclipse Innovation award.

Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation (NSF).


Posted by Peter Teoh

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)