- Standard detectors
- OverridingMethodsMustInvokeSuperDetector
- FindRoughConstants
- SynchronizeAndNullCheckField
- InitializeNonnullFieldsInConstructor
- BooleanReturnNull
- OptionalReturnNull
- ConfusionBetweenInheritedAndOuterMethod
- SynchronizationOnSharedBuiltinConstant
- NoteUnconditionalParamDerefs
- SynchronizeOnClassLiteralNotGetClass
- InfiniteRecursiveLoop
- InfiniteLoop
- VolatileUsage
- InheritanceUnsafeGetResource
- DoInsideDoPrivileged
- HugeSharedStringConstants
- FinalizerNullsFields
- MutableEnum
- InconsistentAnnotations
- RepeatedConditionals
- RedundantConditions
- FormatStringChecker
- LostLoggerDueToWeakReference
- EqualsOperandShouldHaveClassCompatibleWithThis
- CheckImmutableAnnotation
- DontCatchIllegalMonitorStateException
- CloneIdiom
- ComparatorIdiom
- FindFieldSelfAssignment
- FindSelfComparison
- FindSelfComparison2
- DroppedException
- LoadOfKnownNullValue
- DumbMethodInvocations
- URLProblems
- DumbMethods
- NumberConstructor
- FindSqlInjection
- FindDoubleCheck
- FindFinalizeInvocations
- FindHEmismatch
- OverridingEqualsNotSymmetrical
- FindNakedNotify
- FindReturnRef
- FindRunInvocations
- SwitchFallthrough
- FindSpinLoop
- FindNonShortCircuit
- FindTwoLockWait
- FindUnconditionalWait
- FindUninitializedGet
- DontUseEnum
- FindUnsyncGet
- InitializationChain
- IteratorIdioms
- PreferZeroLengthArrays
- SynchronizingOnContentsOfFieldToProtectField
- MutableLock
- FindUselessObjects
- MutableStaticFields
- Naming
- ReadReturnShouldBeChecked
- SerializableIdiom
- StartInConstructor
- FindBadForLoop
- ExplicitSerialization
- UnreadFields
- WaitInLoop
- FindComparatorProblems
- FindNullDeref
- FindNullDerefsInvolvingNonShortCircuitEvaluation
- FindOpenStream
- FindUselessControlFlow
- FindUnreleasedLock
- FindRefComparison
- FindMismatchedWaitOrNotify
- FindEmptySynchronizedBlock
- FindInconsistentSync2
- FindLocalSelfAssignment2
- IncompatMask
- LazyInit
- FindJSR166LockMonitorenter
- FindUncalledPrivateMethods
- UncallableMethodOfAnonymousClass
- StringConcatenation
- InvalidJUnitTest
- BadlyOverriddenAdapter
- BadResultSetAccess
- SuperfluousInstanceOf
- SuspiciousThreadInterrupted
- FindDeadLocalStores
- FindMaskedFields
- WrongMapIterator
- InstantiateStaticClass
- RuntimeExceptionCapture
- DontCatchNullPointerException
- FindFloatEquality
- FindUnsatisfiedObligation
- UnnecessaryMath
- RedundantInterfaces
- MultithreadedInstanceAccess
- BadUseOfReturnValue
- MethodReturnCheck
- IDivResultCastToDouble
- FindBadCast2
- FindUseOfNonSerializableValue
- BadSyntaxForRegularExpression
- VarArgsProblems
- FindPuzzlers
- IntCast2LongAsInstant
- FindSleepWithLockHeld
- DuplicateBranches
- XMLFactoryBypass
- ConfusedInheritance
- QuestionableBooleanAssignment
- AppendingToAnObjectOutputStream
- StaticCalendarDetector
- CheckTypeQualifiers
- CrossSiteScripting
- DontIgnoreResultOfPutIfAbsent
- ReadOfInstanceFieldInMethodInvokedByConstructorInSuperclass
- AtomicityProblem
- DefaultEncodingDetector
- CheckRelaxingNullnessAnnotation
- DontAssertInstanceofInTests
- FindBadEndOfStreamCheck
- ReflectionIncreaseAccessibility
- FindOverridableMethodCall
- ConstructorThrow
- FindInstanceLockOnSharedStaticData
- DontUseFloatsAsLoopCounters
- PermissionsSuper
- FindPotentialSecurityCheckBasedOnUntrustedSource
- FindAssertionsWithSideEffects
- FindPublicAttributes
- FindVulnerableSecurityCheckMethods
- FindArgumentAssertions
- UnnecessaryEnvUsage
- MultipleInstantiationsOfSingletons
This document lists all detectors in SpotBugs.
Standard detectors
These detectors are on by default:
OverridingMethodsMustInvokeSuperDetector
Finds overriding methods that must call super.
FindRoughConstants
Finds constants which roughly (but not precisely) equal to known values like Math.PI.
SynchronizeAndNullCheckField
This detector looks for a field that is synchronized on and then null checked.
InitializeNonnullFieldsInConstructor
Finds non-null fields that are not written to in constructors.
BooleanReturnNull
Looks for methods with Boolean return type that return explicit null values.
OptionalReturnNull
Looks for methods with Optional return type that return explicit null values.
ConfusionBetweenInheritedAndOuterMethod
Looks for potential confusion between inherited and outer methods.
SynchronizationOnSharedBuiltinConstant
This detector looks for synchronization on a shared built-in constant (such as a String).
DL: Synchronization on Boolean (DL_SYNCHRONIZATION_ON_BOOLEAN)
DL: Synchronization on boxed primitive (DL_SYNCHRONIZATION_ON_BOXED_PRIMITIVE)
DL: Synchronization on interned String (DL_SYNCHRONIZATION_ON_INTERNED_STRING)
DL: Synchronization on String literal (DL_SYNCHRONIZATION_ON_SHARED_CONSTANT)
DL: Synchronization on boxed primitive values (DL_SYNCHRONIZATION_ON_UNSHARED_BOXED_PRIMITIVE)
NoteUnconditionalParamDerefs
Analyze all methods in the application to determine which dereference parameters unconditionally. This information is used in a later analysis pass to find call sites where null values may be passed to those methods.
This is a slow detector.
SynchronizeOnClassLiteralNotGetClass
Looks for code that synchronizes on the results of getClass rather than on class literals.
InfiniteRecursiveLoop
Looks for an infinite recursive loop.
IL: A collection is added to itself (IL_CONTAINER_ADDED_TO_ITSELF)
IL: An apparent infinite recursive loop (IL_INFINITE_RECURSIVE_LOOP)
InfiniteLoop
Looks for an infinite loop.
VolatileUsage
Looks for bug patterns in the usage of volatile fields.
InheritanceUnsafeGetResource
Looks for uses of this.getClass().getResource(…), which can give unexpected results if the class is extended by a class in another package.
DoInsideDoPrivileged
Looks for code that should be executed inside doPrivileged blocks.
HugeSharedStringConstants
This detector looks for string constants that are duplicated across multiple classfiles.
FinalizerNullsFields
This detector looks for finalizers that null out fields of a class. This does not help the garbage collector in any way, the nulling out of fields has no effect.
MutableEnum
Looks and warns about mutable enum fields.
ME: Public enum method unconditionally sets its field (ME_ENUM_FIELD_SETTER)
ME: Enum field is public and mutable (ME_MUTABLE_ENUM_FIELD)
InconsistentAnnotations
This detector finds inconsistencies between type qualifiers directly applied to method parameters and uses of those method parameters.
RepeatedConditionals
This detector looks for code containing repeated conditional tests, such as (x == 5 || x == 5).
RedundantConditions
This detector looks for code containing useless conditions like the second condition in this expression: (x >= 10 && x >= 5).
FormatStringChecker
Checks for incorrect format strings.
LostLoggerDueToWeakReference
This detector finds code that behaves differently under OpenJDK 6, where weak references are used to hold onto Loggers.
EqualsOperandShouldHaveClassCompatibleWithThis
Checks for equals methods that check for their operand being an instance of a class that is not compatible with the class defining the equals method.
CheckImmutableAnnotation
Looks for violations of the rules for classes annotated as net.jcip.annotations.Immutable or javax.annotation.concurrent.Immutable.
DontCatchIllegalMonitorStateException
This detector looks for try-catch blocks that catch an IllegalMonitorStateException.
CloneIdiom
This detector looks for violations of the idioms for writing cloneable classes.
CN: Class implements Cloneable but does not define or use clone method (CN_IDIOM)
CN: clone method does not call super.clone() (CN_IDIOM_NO_SUPER_CALL)
CN: Class defines clone() but doesn’t implement Cloneable (CN_IMPLEMENTS_CLONE_BUT_NOT_CLONEABLE)
ComparatorIdiom
This detector looks for violations of the idioms for writing classes that implement Comparator
.
FindFieldSelfAssignment
This detector looks for places where a field is assigned by reading the value of the same field.
FindSelfComparison
This detector looks for places where a value is compared with itself.
SA: Self comparison of field with itself (SA_FIELD_SELF_COMPARISON)
SA: Nonsensical self computation involving a field (e.g., x & x) (SA_FIELD_SELF_COMPUTATION)
SA: Self comparison of value with itself (SA_LOCAL_SELF_COMPARISON)
SA: Nonsensical self computation involving a variable (e.g., x & x) (SA_LOCAL_SELF_COMPUTATION)
FindSelfComparison2
This detector looks for places where a value is compared with itself.
SA: Self comparison of field with itself (SA_FIELD_SELF_COMPARISON)
SA: Nonsensical self computation involving a field (e.g., x & x) (SA_FIELD_SELF_COMPUTATION)
SA: Self comparison of value with itself (SA_LOCAL_SELF_COMPARISON)
SA: Nonsensical self computation involving a variable (e.g., x & x) (SA_LOCAL_SELF_COMPUTATION)
DroppedException
This detector looks for code where an exception is caught, but nothing is done to handle the exception.
LoadOfKnownNullValue
Looks for loads of values known to be null.
DumbMethodInvocations
This detector looks for bad arguments being passed to methods (e.g., substring(0)).
Dm: Hardcoded constant database password (DMI_CONSTANT_DB_PASSWORD)
DMI: Code contains a hard coded reference to an absolute pathname (DMI_HARDCODED_ABSOLUTE_FILENAME)
DMI: Invocation of substring(0), which returns the original value (DMI_USELESS_SUBSTRING)
URLProblems
The equals and hashCode method on java.net.URL
resolve the domain name. As a result, these operations can be very expensive, and this detector looks for places where those methods might be invoked.
Dm: The equals and hashCode methods of URL are blocking (DMI_BLOCKING_METHODS_ON_URL)
Dm: Maps and sets of URLs can be performance hogs (DMI_COLLECTION_OF_URLS)
DumbMethods
This detector looks for calls to pointless methods, such as the no-argument String constructor.
BIT: Bitwise add of signed byte value (BIT_ADD_OF_SIGNED_BYTE)
BIT: Bitwise OR of signed byte value (BIT_IOR_OF_SIGNED_BYTE)
DMI: hasNext method invokes next (DMI_CALLING_NEXT_FROM_HASNEXT)
Dm: Maps and sets of URLs can be performance hogs (DMI_COLLECTION_OF_URLS)
DMI: Double.longBitsToDouble invoked on an int (DMI_LONG_BITS_TO_DOUBLE_INVOKED_ON_INT)
DMI: Random object created and used only once (DMI_RANDOM_USED_ONLY_ONCE)
Dm: Thread passed where Runnable expected (DMI_THREAD_PASSED_WHERE_RUNNABLE_EXPECTED)
Dm: Useless/vacuous call to EasyMock method (DMI_VACUOUS_CALL_TO_EASYMOCK_METHOD)
Dm: Method invokes inefficient Boolean constructor; use Boolean.valueOf(…) instead (DM_BOOLEAN_CTOR)
Bx: Boxing a primitive to compare (DM_BOXED_PRIMITIVE_FOR_COMPARE)
Bx: Boxing/unboxing to parse a primitive (DM_BOXED_PRIMITIVE_FOR_PARSING)
Bx: Method allocates a boxed primitive just to call toString (DM_BOXED_PRIMITIVE_TOSTRING)
Dm: Consider using Locale parameterized version of invoked method (DM_CONVERT_CASE)
Dm: Explicit garbage collection; extremely dubious except in benchmarking code (DM_GC)
Dm: Incorrect combination of Math.max and Math.min (DM_INVALID_MIN_MAX)
Dm: Monitor wait() called on Condition (DM_MONITOR_WAIT_ON_CONDITION)
Dm: Method allocates an object, only to get the class object (DM_NEW_FOR_GETCLASS)
Dm: Method invokes dangerous method runFinalizersOnExit (DM_RUN_FINALIZERS_ON_EXIT)
Dm: Method invokes inefficient new String(String) constructor (DM_STRING_CTOR)
Dm: Method invokes toString() method on a String (DM_STRING_TOSTRING)
Dm: Method invokes inefficient new String() constructor (DM_STRING_VOID_CTOR)
Dm: A thread was created using the default empty run method (DM_USELESS_THREAD)
INT: Bad comparison of int value with long constant (INT_BAD_COMPARISON_WITH_INT_VALUE)
INT: Bad comparison of signed byte (INT_BAD_COMPARISON_WITH_SIGNED_BYTE)
INT: Vacuous bit mask operation on integer value (INT_VACUOUS_BIT_OPERATION)
INT: Vacuous comparison of integer value (INT_VACUOUS_COMPARISON)
NP: Immediate dereference of the result of readLine() (NP_IMMEDIATE_DEREFERENCE_OF_READLINE)
RV: Random value from 0 to 1 is coerced to the integer 0 (RV_01_TO_INT)
RV: Bad attempt to compute absolute value of signed 32-bit hashcode (RV_ABSOLUTE_VALUE_OF_HASHCODE)
RV: Bad attempt to compute absolute value of signed random integer (RV_ABSOLUTE_VALUE_OF_RANDOM_INT)
RV: Remainder of hashCode could be negative (RV_REM_OF_HASHCODE)
RV: Remainder of 32-bit signed random integer (RV_REM_OF_RANDOM_INT)
NumberConstructor
Looks for calls to Number constructors with primitive arguments.
FindSqlInjection
This detector uses data flow analysis to look for invocations of execute methods on SQL statements in which something other than a constant string is passed as an argument.
FindDoubleCheck
This detector looks for instances of double-checked locking.
FindFinalizeInvocations
This detector looks for calls to finalize() and other finalizer-related issues.
FI: Explicit invocation of finalizer (FI_EXPLICIT_INVOCATION)
FI: Finalizer does not call superclass finalizer (FI_MISSING_SUPER_CALL)
FI: Finalizer nullifies superclass finalizer (FI_NULLIFY_SUPER)
FI: Finalizer should be protected, not public (FI_PUBLIC_SHOULD_BE_PROTECTED)
FI: Finalizer does nothing but call superclass finalizer (FI_USELESS)
FindHEmismatch
This detector looks for problems in the definition of the hashCode() and equals() methods.
Co: Abstract class defines covariant compareTo() method (CO_ABSTRACT_SELF)
Co: Covariant compareTo() method defined (CO_SELF_NO_OBJECT)
Eq: Abstract class defines covariant equals() method (EQ_ABSTRACT_SELF)
Eq: Class defines compareTo(…) and uses Object.equals() (EQ_COMPARETO_USE_OBJECT_EQUALS)
Eq: Class doesn’t override equals in superclass (EQ_DOESNT_OVERRIDE_EQUALS)
Eq: Covariant equals() method defined for enum (EQ_DONT_DEFINE_EQUALS_FOR_ENUM)
Eq: equals() method defined that doesn’t override equals(Object) (EQ_OTHER_NO_OBJECT)
Eq: equals() method defined that doesn’t override Object.equals(Object) (EQ_OTHER_USE_OBJECT)
Eq: Covariant equals() method defined, Object.equals(Object) inherited (EQ_SELF_USE_OBJECT)
HE: Class defines equals() but not hashCode() (HE_EQUALS_NO_HASHCODE)
HE: Class defines equals() and uses Object.hashCode() (HE_EQUALS_USE_HASHCODE)
HE: Class defines hashCode() but not equals() (HE_HASHCODE_NO_EQUALS)
HE: Class defines hashCode() and uses Object.equals() (HE_HASHCODE_USE_OBJECT_EQUALS)
HE: Class inherits equals() and uses Object.hashCode() (HE_INHERITS_EQUALS_USE_HASHCODE)
HE: Use of class without a hashCode() method in a hashed data structure (HE_USE_OF_UNHASHABLE_CLASS)
OverridingEqualsNotSymmetrical
Looks for equals methods that override equals methods in a superclass where the equivalence relationship might not be symmetrical.
Eq: equals method compares class names rather than class objects (EQ_COMPARING_CLASS_NAMES)
Eq: equals method fails for subtypes (EQ_GETCLASS_AND_CLASS_CONSTANT)
FindNakedNotify
This detector looks for calls to notify() that don’t seem to modify mutable object state.
FindReturnRef
This detector looks for methods that return mutable static data.
EI: May expose internal representation by returning a buffer sharing non-public data (EI_EXPOSE_BUF)
EI: May expose internal representation by returning reference to mutable object (EI_EXPOSE_REP)
MS: May expose internal representation by returning a buffer sharing non-public data (MS_EXPOSE_BUF)
FindRunInvocations
This detector looks for calls to Thread.run(). It is a fast detector.
SwitchFallthrough
This detector looks for switch statements containing fall through.
SF: Dead store due to switch statement fall through (SF_DEAD_STORE_DUE_TO_SWITCH_FALLTHROUGH)
SF: Switch statement found where one case falls through to the next case (SF_SWITCH_FALLTHROUGH)
SF: Switch statement found where default case is missing (SF_SWITCH_NO_DEFAULT)
FindSpinLoop
This detector looks for loops that spin reading from a field.
FindNonShortCircuit
This detector looks for suspicious uses of non-short-circuiting boolean operators (|
and &
instead of ||
and &&
).
NS: Potentially dangerous use of non-short-circuit logic (NS_DANGEROUS_NON_SHORT_CIRCUIT)
NS: Questionable use of non-short-circuit logic (NS_NON_SHORT_CIRCUIT)
FindTwoLockWait
This detector looks for calls to wait() with two (or more) locks held. It is a slow detector.
FindUnconditionalWait
This detector looks for calls to wait() not in a conditional or loop.
FindUninitializedGet
This detector looks for reads of uninitialized fields in constructors.
DontUseEnum
Checks that fields and methods don’t use the name assert or enum as they are keywords in Java 5.
FindUnsyncGet
This detector looks for get and set methods where the get is unsynchronized while the set is synchronized.
InitializationChain
This detector looks for potentially circular class initialization dependencies.
IteratorIdioms
This detector looks for problems in how Iterator classes are defined.
PreferZeroLengthArrays
This detector looks for methods that return either arrays or an explicit null reference. Returning a zero length array is generally preferred in this context to returning a null reference.
SynchronizingOnContentsOfFieldToProtectField
This detector looks for code that seems to be synchronizing on a field in order to guard updates of that field.
MutableLock
This detector looks for synchronization on objects read from modified fields.
FindUselessObjects
Looks for useless objects.
MutableStaticFields
This detector looks for static fields that may be modified by malicious code.
MS: Field isn’t final and cannot be protected from malicious code (MS_CANNOT_BE_FINAL)
MS: Field should be both final and package protected (MS_FINAL_PKGPROTECT)
MS: Field should be moved out of an interface and made package protected (MS_OOI_PKGPROTECT)
MS: Field isn’t final but should be refactored to be so (MS_SHOULD_BE_REFACTORED_TO_BE_FINAL)
Naming
This detector looks for suspiciously-named methods.
Nm: Class defines equal(Object); should it be equals(Object)? (NM_BAD_EQUAL)
Nm: Class names should start with an upper case letter (NM_CLASS_NAMING_CONVENTION)
Nm: Class is not derived from an Exception, even though it is named as such (NM_CLASS_NOT_EXCEPTION)
Nm: Class defines hashcode(); should it be hashCode()? (NM_LCASE_HASHCODE)
Nm: Class defines tostring(); should it be toString()? (NM_LCASE_TOSTRING)
Nm: Apparent method/constructor confusion (NM_METHOD_CONSTRUCTOR_CONFUSION)
Nm: Method names should start with a lower case letter (NM_METHOD_NAMING_CONVENTION)
Nm: Class names shouldn’t shadow simple name of superclass (NM_SAME_SIMPLE_NAME_AS_SUPERCLASS)
Nm: Very confusing method names (but perhaps intentional) (NM_VERY_CONFUSING_INTENTIONAL)
ReadReturnShouldBeChecked
This detector looks for calls to InputStream.read() or InputStream.skip() where the return value is ignored.
RR: Method ignores results of InputStream.read() (RR_NOT_CHECKED)
RR: Method ignores results of InputStream.skip() (SR_NOT_CHECKED)
SerializableIdiom
This detector looks for potential problems in the implementation of Serializable classes.
RS: Class’s readObject() method is synchronized (RS_READOBJECT_SYNC)
Se: Non-transient non-serializable instance field in serializable class (SE_BAD_FIELD)
Se: Non-serializable class has a serializable inner class (SE_BAD_FIELD_INNER_CLASS)
Se: Non-serializable value stored into instance field of a serializable class (SE_BAD_FIELD_STORE)
Se: Method must be private in order for serialization to work (SE_METHOD_MUST_BE_PRIVATE)
Se: serialVersionUID isn’t final (SE_NONFINAL_SERIALVERSIONID)
Se: serialVersionUID isn’t long (SE_NONLONG_SERIALVERSIONID)
Se: serialVersionUID isn’t static (SE_NONSTATIC_SERIALVERSIONID)
SnVI: Class is Serializable, but doesn’t define serialVersionUID (SE_NO_SERIALVERSIONID)
Se: Prevent overwriting of externalizable objects (SE_PREVENT_EXT_OBJ_OVERWRITE)
Se: Private readResolve method not inherited by subclasses (SE_PRIVATE_READ_RESOLVE_NOT_INHERITED)
Se: The readResolve method must not be declared as a static method. (SE_READ_RESOLVE_IS_STATIC)
Se: Transient field that isn’t set by deserialization. (SE_TRANSIENT_FIELD_NOT_RESTORED)
Se: Transient field of class that isn’t Serializable. (SE_TRANSIENT_FIELD_OF_NONSERIALIZABLE_CLASS)
WS: Class’s writeObject() method is synchronized but nothing else is (WS_WRITEOBJECT_SYNC)
StartInConstructor
This detector looks for constructors that start threads.
FindBadForLoop
This detector looks for incorrect for loops.
ExplicitSerialization
Looks for explicit serialization via readObject and writeObject as evidence that this class is, indeed, serialized.
- :ref:``
UnreadFields
This detector looks for fields whose value is never read.
NP: Read of unwritten public or protected field (NP_UNWRITTEN_PUBLIC_OR_PROTECTED_FIELD)
SIC: Should be a static inner class (SIC_INNER_SHOULD_BE_STATIC)
SIC: Could be refactored into a named static inner class (SIC_INNER_SHOULD_BE_STATIC_ANON)
SIC: Could be refactored into a static inner class (SIC_INNER_SHOULD_BE_STATIC_NEEDS_THIS)
SIC: Deadly embrace of non-static inner class and thread local (SIC_THREADLOCAL_DEADLY_EMBRACE)
SS: Unread field: should this field be static? (SS_SHOULD_BE_STATIC)
ST: Write to static field from instance method (ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD)
UrF: Unread public/protected field (URF_UNREAD_PUBLIC_OR_PROTECTED_FIELD)
UuF: Unused public or protected field (UUF_UNUSED_PUBLIC_OR_PROTECTED_FIELD)
UwF: Unwritten public or protected field (UWF_UNWRITTEN_PUBLIC_OR_PROTECTED_FIELD)
WaitInLoop
This detector looks for calls to wait() that are not in a loop.
FindComparatorProblems
This detector looks for problems in Comparator.compare or Comparable.compareTo implementation.
FindNullDeref
This detector looks for places where a null pointer exception might occur. It also looks for redundant comparisons of reference values against null. It is a slow detector.
NP: Null pointer dereference in method on exception path (NP_ALWAYS_NULL_EXCEPTION)
NP: Method does not check for null argument (NP_ARGUMENT_MIGHT_BE_NULL)
NP: Clone method may return null (NP_CLONE_COULD_RETURN_NULL)
NP: close() invoked on a value that is always null (NP_CLOSING_NULL)
NP: Dereference of the result of readLine() without nullcheck (NP_DEREFERENCE_OF_READLINE_VALUE)
NP: equals() method does not check for null argument (NP_EQUALS_SHOULD_HANDLE_NULL_ARGUMENT)
NP: Null value is guaranteed to be dereferenced (NP_GUARANTEED_DEREF)
NP: Method call passes null to a non-null parameter (NP_NONNULL_PARAM_VIOLATION)
NP: Method may return null, but is declared @Nonnull (NP_NONNULL_RETURN_VIOLATION)
NP: Possible null pointer dereference (NP_NULL_ON_SOME_PATH)
NP: Possible null pointer dereference in method on exception path (NP_NULL_ON_SOME_PATH_EXCEPTION)
NP: Method call passes null for non-null parameter (NP_NULL_PARAM_DEREF)
NP: Method call passes null for non-null parameter (NP_NULL_PARAM_DEREF_ALL_TARGETS_DANGEROUS)
NP: Non-virtual method call passes null for non-null parameter (NP_NULL_PARAM_DEREF_NONVIRTUAL)
NP: Store of null value into field annotated @Nonnull (NP_STORE_INTO_NONNULL_FIELD)
NP: toString method may return null (NP_TOSTRING_COULD_RETURN_NULL)
RCN: Redundant comparison of two null values (RCN_REDUNDANT_COMPARISON_TWO_NULL_VALUES)
RCN: Redundant nullcheck of value known to be non-null (RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE)
RCN: Redundant nullcheck of value known to be null (RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE)
RCN: Nullcheck of value previously dereferenced (RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE)
FindNullDerefsInvolvingNonShortCircuitEvaluation
This detector looks for places where a null pointer exception might occur, and the use of non-short-circuit evaluation causes the usual techniques to fail.
NP: Null value is guaranteed to be dereferenced (NP_GUARANTEED_DEREF)
NP: Possible null pointer dereference (NP_NULL_ON_SOME_PATH)
FindOpenStream
This detector looks for IO stream objects which do not escape the method and do not appear to be closed on all paths out of the method. It is a slow detector.
ODR: Method may fail to close database resource (ODR_OPEN_DATABASE_RESOURCE)
OS: Method may fail to close stream on exception (OS_OPEN_STREAM_EXCEPTION_PATH)
FindUselessControlFlow
This detector looks for control flow statements which have no effect.
FindUnreleasedLock
This detector looks for JSR-166 (java.util.concurrent
) locks which are acquired, but not released on all paths out of the method. It is a moderately fast detector. Note that in order to use this detector, you need to have the java.util.concurrent
package in the auxiliary classpath (or be analyzing the package itself).
UL: Method does not release lock on all paths (UL_UNRELEASED_LOCK)
UL: Method does not release lock on all exception paths (UL_UNRELEASED_LOCK_EXCEPTION_PATH)
FindRefComparison
This detector looks for places where two reference values are compared with the == or != operator, and the class is of a type (such as java.lang.String
) where comparing reference values is generally an error. It is a slow detector.
EC: equals() used to compare array and nonarray (EC_ARRAY_AND_NONARRAY)
EC: Invocation of equals() on an array, which is equivalent to == (EC_BAD_ARRAY_COMPARE)
EC: equals(…) used to compare incompatible arrays (EC_INCOMPATIBLE_ARRAY_COMPARE)
EC: Call to equals() comparing unrelated class and interface (EC_UNRELATED_CLASS_AND_INTERFACE)
EC: Call to equals() comparing different interface types (EC_UNRELATED_INTERFACES)
EC: Call to equals() comparing different types (EC_UNRELATED_TYPES)
EC: Using pointer equality to compare different types (EC_UNRELATED_TYPES_USING_POINTER_EQUALITY)
ES: Comparison of String parameter using == or != (ES_COMPARING_PARAMETER_STRING_WITH_EQ)
ES: Comparison of String objects using == or != (ES_COMPARING_STRINGS_WITH_EQ)
RC: Suspicious reference comparison to constant (RC_REF_COMPARISON_BAD_PRACTICE)
RC: Suspicious reference comparison of Boolean values (RC_REF_COMPARISON_BAD_PRACTICE_BOOLEAN)
FindMismatchedWaitOrNotify
This detector looks for calls to wait(), notify(), or notifyAll() which do not appear to be made on an object which is currently locked. It is a moderately fast detector. This detector is disabled because it is still under development, and produces too many false positives.
FindEmptySynchronizedBlock
This detector looks for empty synchronized blocks.
FindInconsistentSync2
This detector looks for fields that are accessed in an inconsistent manner with respect to locking. It is a slow detector.
FindLocalSelfAssignment2
This detector looks for self assignments of local variables.
IncompatMask
This detector looks for suspicious bitwise logical expressions.
LazyInit
This detector looks for lazy field initialization where the field is not volatile. It is a moderately fast detector.
LI: Incorrect lazy initialization of static field (LI_LAZY_INIT_STATIC)
LI: Incorrect lazy initialization and update of static field (LI_LAZY_INIT_UPDATE_STATIC)
FindJSR166LockMonitorenter
This detector looks for ordinary synchronization performed on JSR166 locks. It is a moderately fast detector.
JLM: Synchronization performed on Lock (JLM_JSR166_LOCK_MONITORENTER)
JLM: Synchronization performed on util.concurrent instance (JLM_JSR166_UTILCONCURRENT_MONITORENTER)
FindUncalledPrivateMethods
This detector looks for private methods that are never called.
UncallableMethodOfAnonymousClass
This detector looks for anonymous inner classes that define methods that are probably intended to but do not override methods in a superclass.
StringConcatenation
This detector looks for String concatenation in loops using +.
InvalidJUnitTest
This detector looks for JUnit tests that are malformed.
IJU: TestCase declares a bad suite method (IJU_BAD_SUITE_METHOD)
IJU: TestCase defines setUp that doesn’t call super.setUp() (IJU_SETUP_NO_SUPER)
IJU: TestCase implements a non-static suite method (IJU_SUITE_NOT_STATIC)
IJU: TestCase defines tearDown that doesn’t call super.tearDown() (IJU_TEARDOWN_NO_SUPER)
BadlyOverriddenAdapter
This detector looks for code that extends an Adapter class and overrides a Listener method with the wrong signature.
BadResultSetAccess
This detector looks for calls to getXXX or setXXX methods of a result set where the field index is 0. As ResultSet fields start at index 1, this is always a mistake.
SuperfluousInstanceOf
This detector looks for type checks using the instanceof operator where the determination can be done statically.
SuspiciousThreadInterrupted
This detector looks for calls to Thread.interrupted() from a non-static context. If it is called from Thread.currentThread().interrupted(), then it is just a useless exercise, just use Thread.interrupted(). However if it is called on an arbitrary thread object, it is most probably an error, as interrupted() is always called on the current thread.
FindDeadLocalStores
This detector looks for assignments to local variables that are never subsequently read. It is a moderately fast detector.
DLS: Useless increment in return statement (DLS_DEAD_LOCAL_INCREMENT_IN_RETURN)
DLS: Dead store of null to local variable (DLS_DEAD_LOCAL_STORE_OF_NULL)
DLS: Dead store to local variable that shadows field (DLS_DEAD_LOCAL_STORE_SHADOWS_FIELD)
DLS: Dead store of class literal (DLS_DEAD_STORE_OF_CLASS_LITERAL)
FindMaskedFields
This detector looks for class level fields that are masked by local fields defined in methods.
MF: Class defines field that masks a superclass field (MF_CLASS_MASKS_FIELD)
MF: Method defines a variable that obscures a field (MF_METHOD_MASKS_FIELD)
WrongMapIterator
This detector looks for accessing the value of a Map entry, using a key that was retrieved from a keySet iterator.
InstantiateStaticClass
This detector looks for code that creates objects based on classes that only define static methods.
RuntimeExceptionCapture
This detector looks for catch clauses that catch Exception, when no code in the block throws Exception.
DontCatchNullPointerException
Nullpointer exceptions should not be caught.
FindFloatEquality
Looks for floating point equality expressions. A fast detector.
FE: Test for floating point equality (FE_FLOATING_POINT_EQUALITY)
FE: Doomed test for equality to NaN (FE_TEST_IF_EQUAL_TO_NOT_A_NUMBER)
FindUnsatisfiedObligation
This detector looks for I/O streams and database resources that are not cleaned up on all paths out of a method. This is a slow detector.
UnnecessaryMath
This detector looks for code that calls java.lang.Math static methods on constant values, where the resultant value is a statically known constant. It is faster, and sometimes more accurate, to use the constant instead.
RedundantInterfaces
This detector looks for classes that declare they implement the same interface as a super class. This is redundant, if a superclass implements an interface, so does the subclass.
MultithreadedInstanceAccess
This detector looks for potential problems in implementing the Struts framework.
BadUseOfReturnValue
Looks for cases where the return value of a function is discarded after being checked for non-null.
MethodReturnCheck
This detector looks for calls to methods where the return value is suspiciously ignored.
RV: Exception created and dropped rather than thrown (RV_EXCEPTION_NOT_THROWN)
RV: Method ignores exceptional return value (RV_RETURN_VALUE_IGNORED_BAD_PRACTICE)
RV: Method ignores return value, is this OK? (RV_RETURN_VALUE_IGNORED_INFERRED)
RV: Return value of method without side effect is ignored (RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT)
IDivResultCastToDouble
This detector looks for places where the result of integer division is cast to double. Often, what was meant was to cast the integer operands to double and then perform the division.
FindBadCast2
This detector looks for bad casts of object references using data flow analysis.
BC: Questionable cast to abstract collection (BC_BAD_CAST_TO_ABSTRACT_COLLECTION)
BC: Questionable cast to concrete collection (BC_BAD_CAST_TO_CONCRETE_COLLECTION)
BC: Impossible downcast of toArray() result (BC_IMPOSSIBLE_DOWNCAST_OF_TOARRAY)
BC: instanceof will always return false (BC_IMPOSSIBLE_INSTANCEOF)
BC: Unchecked/unconfirmed cast of return value from method (BC_UNCONFIRMED_CAST_OF_RETURN_VALUE)
BC: instanceof will always return true (BC_VACUOUS_INSTANCEOF)
NP: A known null value is checked to see if it is an instance of a type (NP_NULL_INSTANCEOF)
FindUseOfNonSerializableValue
This detector looks for uses of non Serializable objects in contexts that require them to be serializable.
BadSyntaxForRegularExpression
This detector looks for regular expressions that have invalid syntax.
RE: Invalid syntax for regular expression (RE_BAD_SYNTAX_FOR_REGULAR_EXPRESSION)
RE: File.separator used for regular expression (RE_CANT_USE_FILE_SEPARATOR_AS_REGULAR_EXPRESSION)
RE: “.” or “|” used for regular expression (RE_POSSIBLE_UNINTENDED_PATTERN)
VarArgsProblems
Looks for problems with arising from Java 5 varargs.
FindPuzzlers
This detector looks for miscellaneous small errors mentioned by Joshua Bloch and Neal Gafter in their work on Programming Puzzlers.
BSHIFT: Possible bad parsing of shift operation (BSHIFT_WRONG_ADD_PRIORITY)
Bx: Primitive value is boxed and then immediately unboxed (BX_BOXING_IMMEDIATELY_UNBOXED)
Bx: Boxed value is unboxed and then immediately reboxed (BX_UNBOXING_IMMEDIATELY_REBOXED)
DLS: Useless assignment in return statement (DLS_DEAD_LOCAL_STORE_IN_RETURN)
DMI: Invocation of hashCode on an array (DMI_INVOKING_HASHCODE_ON_ARRAY)
USELESS_STRING: Invocation of toString on an array (DMI_INVOKING_TOSTRING_ON_ARRAY)
EC: Invocation of equals() on an array, which is equivalent to == (EC_BAD_ARRAY_COMPARE)
BSHIFT: 32 bit int shifted by an amount not in the range -31..31 (ICAST_BAD_SHIFT_AMOUNT)
ICAST: Result of integer multiplication cast to long (ICAST_INTEGER_MULTIPLY_CAST_TO_LONG)
BSHIFT: Unsigned right shift cast to short/byte (ICAST_QUESTIONABLE_UNSIGNED_RIGHT_SHIFT)
IM: Computation of average could overflow (IM_AVERAGE_COMPUTATION_COULD_OVERFLOW)
IM: Check for oddness that won’t work for negative numbers (IM_BAD_CHECK_FOR_ODD)
IM: Integer multiply of result of integer remainder (IM_MULTIPLYING_RESULT_OF_IREM)
PZ: Don’t reuse entry objects in iterators (PZ_DONT_REUSE_ENTRY_OBJECTS_IN_ITERATORS)
RV: Negating the result of compareTo()/compare() (RV_NEGATING_RESULT_OF_COMPARETO)
IntCast2LongAsInstant
Finds uses of 32-bit values to describe milliseconds since the epoch.
FindSleepWithLockHeld
This detector looks for calls to Thread.sleep() made with a lock held. It is a slow detector.
DuplicateBranches
This detector looks for if/else or switch statements that have the same code for two branches, thus rendering the test useless. This often is caused by copying and pasting the two branches, causing incorrect logic for the one branch.
DB: Method uses the same code for two branches (DB_DUPLICATE_BRANCHES)
DB: Method uses the same code for two switch clauses (DB_DUPLICATE_SWITCH_CLAUSES)
XMLFactoryBypass
This detector looks for direct allocations of implementations of XML interfaces. This ties the code to a specific implementation, rather than using the supplied factory pattern to create these objects.
ConfusedInheritance
This detector looks for final classes that declare protected members. As this class cannot be derived from, the use of protected access for members is incorrect. The access should be changed to public or private to represent the correct intention of the field. This was probably caused by a change in use for this class, without completely changing all of the class to the new paradigm.
QuestionableBooleanAssignment
This detector looks for simple assignments of literal boolean values to variables in conditional expressions.
AppendingToAnObjectOutputStream
Looks for an attempt to append to an object output stream.
StaticCalendarDetector
This detector warns about static fields of type java.util.Calendar or java.text.DateFormat (and subclasses) because Calendars are inherently unsafe for multithreaded use.
STCAL: Call to static Calendar (STCAL_INVOKE_ON_STATIC_CALENDAR_INSTANCE)
STCAL: Call to static DateFormat (STCAL_INVOKE_ON_STATIC_DATE_FORMAT_INSTANCE)
STCAL: Static Calendar field (STCAL_STATIC_CALENDAR_INSTANCE)
STCAL: Static DateFormat (STCAL_STATIC_SIMPLE_DATE_FORMAT_INSTANCE)
CheckTypeQualifiers
Check for violations of properties specified by JSR-305 type qualifier annotations.
CrossSiteScripting
This detector looks for obvious/blatant cases of cross site scripting vulnerabilities.
HRS: HTTP cookie formed from untrusted input (HRS_REQUEST_PARAMETER_TO_COOKIE)
HRS: HTTP Response splitting vulnerability (HRS_REQUEST_PARAMETER_TO_HTTP_HEADER)
PT: Absolute path traversal in servlet (PT_ABSOLUTE_PATH_TRAVERSAL)
PT: Relative path traversal in servlet (PT_RELATIVE_PATH_TRAVERSAL)
XSS: JSP reflected cross site scripting vulnerability (XSS_REQUEST_PARAMETER_TO_JSP_WRITER)
XSS: Servlet reflected cross site scripting vulnerability (XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER)
DontIgnoreResultOfPutIfAbsent
Checks that if the result of putIfAbsent is ignored, the value passed as the second argument is not reused.
ReadOfInstanceFieldInMethodInvokedByConstructorInSuperclass
Checks for methods invoked from constructors for superclasses.
AtomicityProblem
Finds sequences of operations (e.g., get/put) on a concurrent abstraction that will not be executed atomically.
DefaultEncodingDetector
Checks for calls to methods which perform a byte to String (or String to byte) conversion using the user’s default platform encoding. This can cause the application behavior to vary between platforms.
CheckRelaxingNullnessAnnotation
Checks that overriding methods do not relax @Nonnull (made @CheckForNull) on return values or @CheckForNull (made @Nonnull) on parameters.
NP: Method tightens nullness annotation on parameter (NP_METHOD_PARAMETER_TIGHTENS_ANNOTATION)
NP: Method relaxes nullness annotation on return value (NP_METHOD_RETURN_RELAXING_ANNOTATION)
DontAssertInstanceofInTests
Detector for patterns in JUnit tests where the type of an object is checked by asserting the instanceof operator.
This should be avoided as the ClassCastException that would result from an improper cast may provide more information regarding the cause of the error than a “false is not true” message which would result from asserting the result of the instanceof operator.
It is a fast detector
FindBadEndOfStreamCheck
Detector for patterns where the return value of java.io.FileInputStream.read() or java.io.FileReader.read() is converted before checking against -1.
Both methods return an int. If this int is converted to byte (in the case of FileInputStream.read()) then -1 and the byte 0xFF become indistinguishable. If it is converted to char (in the case of FileReader.read()) then -1 becomes 0xFFFF which is Character.MAX_VALUE since characters are unsigned in Java.
ReflectionIncreaseAccessibility
Detector for public methods instantiating a class they get in their parameter.
An attacker may invoke this method with a class that has no public constructor.
FindOverridableMethodCall
Detector for patterns where a constructor, a clone(), or a readObject() method calls an overridable method.
Calling an overridable method from a constructor may result in the use of uninitialized data. Calling such method from a clone(), or readObject() method is insecure.
MC: An overridable method is called from the clone() method. (MC_OVERRIDABLE_METHOD_CALL_IN_CLONE)
MC: An overridable method is called from a constructor (MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR)
ConstructorThrow
Finds constructors that throw exceptions.
FindInstanceLockOnSharedStaticData
Detector for patterns where a shared static data is modified by either an instance level non-static synchronized method, or inside a synchronized block, which used a non-static lock object.
Programs must not use instance locks to protect static shared data because instance locks are ineffective when two or more instances of the class are created. Consequently, failure to use a static lock object leaves the shared state unprotected against concurrent access.
DontUseFloatsAsLoopCounters
Checks for floats in loop counters.
PermissionsSuper
Checks method getPermissions() of classes implementing interface java.security.SecureClassLoader. The methods must always call super.getPermissions() to get the initial value of the object which they return at the end.
FindPotentialSecurityCheckBasedOnUntrustedSource
Looks for potential security checks on an untrusted source before entering a doPrivileged block.
FindAssertionsWithSideEffects
Finds assertions with side effects.
ASE: Expression in assertion may produce a side effect (ASE_ASSERTION_WITH_SIDE_EFFECT)
ASE: Method invoked in assertion may produce a side effect (ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD)
FindPublicAttributes
This detector looks for public attributes that are also written by the methods of the class.
PA: Mutable object-type field is public (PA_PUBLIC_MUTABLE_OBJECT_ATTRIBUTE)
PA: Primitive field is public (PA_PUBLIC_PRIMITIVE_ATTRIBUTE)
FindVulnerableSecurityCheckMethods
Methods that perform security checks should be prevented from being overridden, so they must be declared as private or final. Otherwise, these methods can be compromised when a malicious subclass overrides them and omits the checks.
FindArgumentAssertions
Finds assertions that validate public method arguments.
UnnecessaryEnvUsage
Checks for calls of System.getenv(), where the variable has an equivalent Java property too.
MultipleInstantiationsOfSingletons
This detector looks for violations of the idioms for writing classes using singleton design pattern.