This chapter describes how to integrate SpotBugs into a Maven project.

Add spotbugs-maven-plugin to your pom.xml

Add <plugin> into your pom.xml like below:

  1. <plugin>
  2.   <groupId>com.github.spotbugs</groupId>
  3.   <artifactId>spotbugs-maven-plugin</artifactId>
  4.   <version>4.8.5.0</version>
  5.   <dependencies>
  6.     <!-- overwrite dependency on spotbugs if you want to specify the version of spotbugs -->
  7.     <dependency>
  8.       <groupId>com.github.spotbugs</groupId>
  9.       <artifactId>spotbugs</artifactId>
  10.       <version>4.8.5</version>
  11.     </dependency>
  12.   </dependencies>
  13. </plugin>

Integrate Find Security Bugs into spotbugs-maven-plugin

Are you looking for additional security detectors for SpotBugs? We suggest you to check the Find Security Bugs a SpotBugs plugin for security audits of Java web and Android applications. It can detect 138 different vulnerability types, including SQL/HQL Injection, Command Injection, XPath Injection, and Cryptography weaknesses.

To integrate Find Security Bugs into SpotBugs plugin, you can configure your pom.xml like below:

  1. [...]
  2. <build>
  3.     <plugins>
  4.         [...]
  5.         <plugin>
  6.             <groupId>com.github.spotbugs</groupId>
  7.             <artifactId>spotbugs-maven-plugin</artifactId>
  8.             <version>4.8.5.0</version>
  9.             <configuration>
  10.                 <includeFilterFile>spotbugs-security-include.xml</includeFilterFile>
  11.                 <excludeFilterFile>spotbugs-security-exclude.xml</excludeFilterFile>
  12.                 <plugins>
  13.                     <plugin>
  14.                         <groupId>com.h3xstream.findsecbugs</groupId>
  15.                         <artifactId>findsecbugs-plugin</artifactId>
  16.                         <version>1.12.0</version>
  17.                     </plugin>
  18.                 </plugins>
  19.             </configuration>
  20.         </plugin>
  21.     </plugins>
  22. </build>

The <plugins> option defines a collection of PluginArtifact to work on. Please, specify “Find Security Bugs” by adding its groupId, artifactId, version.

The <includeFilterFile> and <excludeFilterFile> specify the filter files to include and exclude bug reports, respectively (see Filter file for more details). Optionally, you can limit the research to the security category by adding files like below:

spotbugs-security-include.xml

  1. <FindBugsFilter>
  2.     <Match>
  3.         <Bug category="SECURITY"/>
  4.     </Match>
  5. </FindBugsFilter>

spotbugs-security-exclude.xml

  1. <FindBugsFilter>
  2. </FindBugsFilter>

Goals of spotbugs-maven-plugin

spotbugs goal

spotbugs goal analyses target project by SpotBugs. For detail, please refer spotbugs goal description in maven site.

check goal

check goal runs analysis like spotbugs goal, and make the build failed if it found any bugs. For detail, please refer check goal description in maven site.

gui goal

gui goal launches SpotBugs GUI to check analysis result. For detail, please refer gui goal description in maven site.

help goal

help goal displays usage of this Maven plugin.