FindBugs錯(cuò)誤修改中文說明大全

FindBug 錯(cuò)誤修改中文說明大全 復(fù)制你的 Pattern id 然后用 Ctrl F 快速查找定位 Security 關(guān)于代碼安全性防護(hù) 序號(hào) Description 備注 1 Dm Hardcoded constant database password DMI CONSTANT DB PASSWORD 代碼中創(chuàng)建 DB 的密碼時(shí)采用了寫死的密碼 2 Dm Empty database password DMI EMPTY DB PASSWORD 創(chuàng)建數(shù)據(jù)庫連接時(shí)沒有為數(shù)據(jù)庫設(shè)置密碼 這會(huì)使數(shù)據(jù)庫沒有 必要的保護(hù) 3 HRS HTTP cookie formed from untrusted input HRS REQUEST PARAMETER TO COOKIE 此代碼使用不受信任的 HTTP 參數(shù)構(gòu)造一個(gè) HTTP Cookie 4 HRS HTTP Response splitting vulnerability HRS REQUEST PARAMETER TO HTTP HEADER 在代碼中直接把一個(gè) HTTP 的參數(shù)寫入一個(gè) HTTP 頭文件中 它為 HTTP 的響應(yīng)暴露了漏洞 5 SQL Nonconstant string passed to execute method on an SQL statement SQL NONCONSTANT STRING PASSED TO EXECUTE 該方法以字符串的形式來調(diào)用 SQLstatement 的 execute 方法 它似乎是動(dòng)態(tài)生成 SQL 語句的方法 這會(huì)更容易受到 SQL 注 入攻擊 6 XSS JSP reflected cross site scripting vulnerability XSS REQUEST PARAMETER TO JSP WRITER 在代碼中在 JSP 輸出中直接寫入一個(gè) HTTP 參數(shù) 這會(huì)造成一 個(gè)跨站點(diǎn)的腳本漏洞 Experimental 序號(hào) Description 備注 1 LG Potential lost logger changes due to weak reference in OpenJDK LG LOST LOGGER DUE TO WEAK REFERENCE OpenJDK 的引入了一種潛在的不兼容問題 特別是 java util logging Logger 的行為改變時(shí) 它現(xiàn)在使用 內(nèi)部弱引用 而不是強(qiáng)引用 logger 配置改變 它 就是丟失對(duì) logger 的引用 這本是一個(gè)合理的變化 但不幸的是一些代碼對(duì)舊的行為有依賴關(guān)系 這意味 著 當(dāng)進(jìn)行垃圾收集時(shí)對(duì) logger 配置將會(huì)丟失 例如 public static void initLogging throws Exception Logger logger Logger getLogger edu umd cs logger addHandler new FileHandler call to change logger configuration logger setUseParentHandlers false another call to change logger configuration 該方法結(jié)束時(shí) logger 的引用就丟失了 如果你剛剛結(jié) 束調(diào)用 initLogging 方法后進(jìn)行垃圾回收 logger 的 配置將會(huì)丟失 因?yàn)橹挥斜３钟涗浧魅跻?public static void main String args throws Exception initLogging adds a file handler to the logger System gc logger configuration lost Logger getLogger edu umd cs info Some message this isn t logged to the file as expected 2 OBL Method may fail to clean up stream or resource OBL UNSATISFIED OBLIGATION 這種方法可能無法清除 關(guān)閉 處置 一個(gè)流 數(shù)據(jù) 庫對(duì)象 或其他資源需要一個(gè)明確的清理行動(dòng) 一般來說 如果一個(gè)方法打開一個(gè)流或其他資源 該 方法應(yīng)該使用 try finally 塊來確保在方法返回之前流 或資源已經(jīng)被清除了 這種錯(cuò)誤模式基本上和 OS OPEN STREAM 和 ODR OPEN DATABASE RESOURCE 錯(cuò)誤模式相同 但是是在不同在靜態(tài)分析技術(shù) 我們正為這個(gè)錯(cuò)誤模 式的效用收集反饋意見 Bad practice 代碼實(shí)現(xiàn)中的一些壞習(xí)慣 序 號(hào) Description 備 注 1 AM Creates an empty jar file entry AM CREATES EMPTY JAR FILE ENTRY 調(diào)用 putNextEntry 方法寫入新的 jar 文件條目時(shí)立即調(diào)用 closeEntry 方法 這樣會(huì)造成 JarFile 條目為空 2 AM Creates an empty zip file entry AM CREATES EMPTY ZIP FILE ENTRY 調(diào)用 putNextEntry 方法寫入新的 zip 文件條目時(shí)立即調(diào)用 closeEntry 方法 這樣會(huì)造成 ZipFile 條目為空 3 BC Equals method should not assume anything about the type of its argument BC EQUALS METHOD SHOULD WORK FOR ALL OBJECTS equals Object o 方法不能對(duì)參數(shù) o 的類型做任何的假設(shè) 比較此 對(duì)象與指定的對(duì)象 當(dāng)且僅當(dāng)該參數(shù)不為 null 并且是表示與此對(duì) 象相同的類型的對(duì)象時(shí) 結(jié)果才為 true 4 BC Random object created and used only once DMI RANDOM USED ONLY ONCE 隨機(jī)創(chuàng)建對(duì)象只使用過一次就拋棄 5 BIT Check for sign of bitwise operation BIT SIGNED CHECK 檢查位操作符運(yùn)行是否合理 event detail else if o instanceof String return name equals o else return false 21 Eq Class defines compareTo and uses Object equals EQ COMPARETO USE OBJECT EQUALS 類中定義了 compareTo 方法但是繼承了 Object 中的 compareTo 方法 22 Eq equals method fails for subtypes EQ GETCLASS AND CLASS CONSTANT 類中的 equals 方法可能被子類中的方法所破壞 當(dāng)使用類似于 Foo class o getClass 的判斷時(shí)考慮用 this getClass o getClass 來替換 23 Eq Covariant equals method defined EQ SELF NO OBJECT 類中定義了多個(gè) equals 方法 正確的做法是覆寫 Object 中的 equals 方法 它的參數(shù)為 Object 類型的對(duì)象 24 FI Empty finalizer should be deleted FI EMPTY 為空的 finalizer 方法應(yīng)該刪除 一下關(guān)于 finalizer 的內(nèi)容省略 25 GC Unchecked type in generic call GC UNCHECKED TYPE IN GENERIC CALL This call to a generic collection method passes an argument while compile type Object where a specific type from the generic type parameters is expected Thus neither the standard Java type system nor static analysis can provide useful information on whether the object being passed as a parameter is of an appropriate type 26 HE Class defines equals but not hashCode HE EQUALS NO HASHCODE 方法定義了 equals 方法卻沒有定義 hashCode 方法 27 HE Class defines hashCode but not equals HE HASHCODE NO EQUALS 類定義了 hashCode 方法去沒有定義 equal 方法 28 HE Class defines equals and uses Object hashCode HE EQUALS USE HASHCODE 一個(gè)類覆寫了 equals 方法 沒有覆寫 hashCode 方法 使用了 Object 對(duì)象的 hashCode 方法 29 HE Class inherits equals and uses Object hashCode HE INHERITS EQUALS USE HASHCODE 子類繼承了父類的 equals 方法卻使用了 Object 的 hashCode 方法 30 IC Superclass uses subclass during initialization IC SUPERCLASS USES SUBCLASS DURING INITIALIZATION 子類在父類未初始化之前使用父類對(duì)象實(shí)例 public class CircularClassInitialization static class InnerClassSingleton extends CircularClassInitialization static InnerClassSingleton singleton new InnerClassSingleton static CircularClassInitialization foo InnerClassSingleton singleton 31 IMSE Dubious catching of IllegalMonitorStateException IMSE DONT CATCH IMSE 捕捉違法的監(jiān)控狀態(tài)異常 例如當(dāng)沒有獲取到對(duì)象鎖時(shí)使用其 wait 和 notify 方法 32 ISC Needless instantiation of class that only supplies static methods ISC INSTANTIATE STATIC CLASS 為使用靜態(tài)方法而創(chuàng)建一個(gè)實(shí)例對(duì)象 調(diào)用靜態(tài)方法時(shí)只需要使用 類名 靜態(tài)方法名就可以了 33 It Iterator next method can t throw NoSuchElementException IT NO SUCH ELEMENT 迭代器的 next 方法不能夠拋出 NoSuchElementException 34 J2EE Store of non serializable object into HttpSession J2EE STORE OF NON SERIALIZABLE OBJECT INTO SESSION 在 HttpSession 對(duì)象中保存非連續(xù)的對(duì)象 35 JCIP Fields of immutable classes should be final JCIP FIELD ISNT FINAL IN IMMUTABLE CLASS The class is annotated with net jcip annotations Immutable and the rules for that annotation require that all fields are final 36 NP Method with Boolean return type returns explicit null NP BOOLEAN RETURN NULL 返回值為 boolean 類型的方法直接返回 null 這樣會(huì)導(dǎo)致空指針異 常 37 NP equals method does not check for null argument NP EQUALS SHOULD HANDLE NULL ARGUMENT 變量調(diào)用 equals 方法時(shí)沒有進(jìn)行是否為 null 的判斷 38 NP toString method may return null NP TOSTRING COULD RETURN NULL toString 方法可能返回 null 39 Nm Class names should start with an upper case letter NM CLASS NAMING CONVENTION 類的名稱以大寫字母名稱開頭 40 Nm Class is not derived from an Exception even though it is named as such NM CLASS NOT EXCEPTION 類的名稱中含有 Exception 但是卻不是一個(gè)異常類的子類 這種名 稱會(huì)造成混淆 41 Nm Confusing method names NM CONFUSING 令人迷惑的方面命名 42 Nm Field names should start with a lower case letter NM FIELD NAMING CONVENTION 非 final 類型的字段需要遵循駝峰命名原則 43 Nm Use of identifier that is a keyword in later versions of Java NM FUTURE KEYWORD USED AS IDENTIFIER 驗(yàn)證是否是 java 預(yù)留關(guān)鍵字 44 Nm Use of identifier that is a keyword in later versions of Java NM FUTURE KEYWORD USED AS MEMBER IDENTIFIER 驗(yàn)證是否時(shí) java 中的關(guān)鍵字 45 Nm Method names should start with a lower case letter NM METHOD NAMING CONVENTION 方法名稱以小寫字母開頭 46 Nm Class names shouldn t shadow simple name of implemented interface NM SAME SIMPLE NAME AS INTERFACE 實(shí)現(xiàn)同一接口實(shí)現(xiàn)類不能使用相同的名稱 即使它們位于不同的包 中 47 Nm Class names shouldn t shadow simple name of superclass NM SAME SIMPLE NAME AS SUPERCLASS 繼承同一父類的子類不能使用相同的名稱 即使它們位于不同的包 中 48 Nm Very confusing method names but perhaps intentional NM VERY CONFUSING INTENTIONAL 很容易混淆的方法命名 例如方法的名稱名稱使用使用大小寫來區(qū) 別兩個(gè)不同的方法 49 Nm Method doesn t override method in superclass due to wrong package for parameter NM WRONG PACKAGE INTENTIONAL 由于錯(cuò)誤引用了不同包中相同類名的對(duì)象而不能夠正確的覆寫父類 中的方法 import alpha Foo public class A public int f Foo x return 17 import beta Foo public class B extends A public int f Foo x return 42 public int f alpha Foo x return 27 50 ODR Method may fail to close database resource ODR OPEN DATABASE RESOURCE 方法中可能存在關(guān)閉數(shù)據(jù)連接失敗的情況 51 OS Method may fail to close stream OS OPEN STREAM 方法中可能存在關(guān)閉流失敗的情況 52 OS Method may fail to close stream on exception OS OPEN STREAM EXCEPTION PATH 方法中可能存在關(guān)閉流時(shí)出現(xiàn)異常情況 53 RC Suspicious reference comparison to constant RC REF COMPARISON BAD PRACTICE 當(dāng)兩者為不同類型的對(duì)象時(shí)使用 equals 方法來比較它們的值是否相 等 而不是使用 方法 例如比較的兩者為 java lang Integer java lang Float 54 RC Suspicious reference comparison of Boolean values RC REF COMPARISON BAD PRACTICE BOOLEAN 使用 或者 操作符來比較兩個(gè) Boolean 類型的對(duì)象 建議使 用 equals 方法 55 RR Method ignores results of InputStream read RR NOT CHECKED InputStream read 方法忽略返回的多個(gè)字符 如果對(duì)結(jié)果沒有檢查 就沒法正確處理用戶讀取少量字符請(qǐng)求的情況 56 RR Method ignores results of InputStream skip SR NOT CHECKED InputStream skip 方法忽略返回的多個(gè)字符 如果對(duì)結(jié)果沒有檢查 就沒法正確處理用戶跳過少量字符請(qǐng)求的情況 57 RV Method ignores exceptional return value RV RETURN VALUE IGNORED BAD PRACTICE 方法忽略返回值的異常信息 58 SI Static initializer creates instance before all static final fields assigned SI INSTANCE BEFORE FINALS ASSIGNED 在所有的 static final 字段賦值之前去使用靜態(tài)初始化的方法創(chuàng)建一 個(gè)類的實(shí)例 59 Se Non serializable value stored into instance field of a serializable class SE BAD FIELD STORE 非序列化的值保存在聲明為序列化的的非序列化字段中 60 Se Comparator doesn t implement Serializable SE COMPARATOR SHOULD BE SERIALIZABLE Comparator 接口沒有實(shí)現(xiàn) Serializable 接口 61 Se Serializable inner class SE INNER CLASS 序列化內(nèi)部類 62 Se serialVersionUID isn t final SE NONFINAL SERIALVERSIONID 關(guān)于 UID 類的檢查內(nèi)容省略 63 Se Class is Serializable but its superclass doesn t define a void constructor SE NO SUITABLE CONSTRUCTOR 子類序列化時(shí)父類沒有提供一個(gè) void 的構(gòu)造函數(shù) 64 Se Class is Externalizable but doesn t define a void constructor SE NO SUITABLE CONSTRUCTOR FOR EXTERNALIZATION Externalizable 實(shí)例類沒有定義一個(gè) void 類型的構(gòu)造函數(shù) 65 Se The readResolve method must be declared with a return type of Object SE READ RESOLVE MUST RETURN OBJECT readResolve 從流中讀取類的一個(gè)實(shí)例 此方法必須聲明返回一個(gè) Object 類型的對(duì)象 66 Se Transient field that isn t set by deserialization SE TRANSIENT FIELD NOT RESTORED This class contains a field that is updated at multiple places in the class thus it seems to be part of the state of the class However since the field is marked as transient and not set in readObject or readResolve it will contain the default value in any deserialized instance of the class 67 SnVI Class is Serializable but doesn t define serialVersionUID SE NO SERIALVERSIONID 一個(gè)類實(shí)現(xiàn)了 Serializable 接口但是沒有定義 serialVersionUID 類 型的變量 序列化運(yùn)行時(shí)使用一個(gè)稱為 serialVersionUID 的版本 號(hào)與每個(gè)可序列化類相關(guān)聯(lián) 該序列號(hào)在反序列化過程中用于驗(yàn)證 序列化對(duì)象的發(fā)送者和接收者是否為該對(duì)象加載了與序列化兼容的 類 如果接收者加載的該對(duì)象的類的 serialVersionUID 與對(duì)應(yīng)的 發(fā)送者的類的版本號(hào)不同 則反序列化將會(huì)導(dǎo)致 InvalidClassException 可序列化類可以通過聲明名為 serialVersionUID 的字段 該字段必須是靜態(tài) static 最終 final 的 long 型字段 顯式聲明其自己的 serialVersionUID ANY ACCESS MODIFIER static final long serialVersionUID 42L 68 UI Usage of GetResource may be unsafe if class is extended UI INHERITANCE UNSAFE GETRESOURCE 當(dāng)一個(gè)類被子類繼承后不要使用 this getClass getResource 來 獲取資源 Correctness 關(guān)于代碼正確性相關(guān)方面的 序 號(hào) Description 備 注 1 BC Impossible cast BC IMPOSSIBLE CAST 不可能的類轉(zhuǎn)換 執(zhí)行時(shí)會(huì)拋出 ClassCastException 2 BC Impossible downcast BC IMPOSSIBLE DOWNCAST 父類在向下進(jìn)行類型轉(zhuǎn)換時(shí)拋出 ClassCastException 3 BC Impossible downcast of toArray result BC IMPOSSIBLE DOWNCAST OF TOARRAY 集合轉(zhuǎn)換為數(shù)組元素時(shí)發(fā)生的類轉(zhuǎn)換錯(cuò)誤 This code is casting the result of calling toArray on a collection to a type more specific than Object as in String getAsArray Collection c return String c toArray This will usually fail by throwing a ClassCastException The toArray of almost all collections return an Object They can t really do anything else since the Collection object has no reference to the declared generic type of the collection The correct way to do get an array of a specific type from a collection is to use c toArray new String or c toArray new String c size the latter is slightly more efficient 4 BC instanceof will always return false BC IMPOSSIBLE INSTANCEOF 采用 instaneof 方法進(jìn)行比較時(shí)總是返回 false 前提是保證它不是由 于某些邏輯錯(cuò)誤造成的 5 BIT Incompatible bit masks BIT AND 錯(cuò)誤的使用 System out println a1 hashCode System out println java util Arrays hashCode a1 16 DMI Double longBitsToDouble invoked on an int DMI LONG BITS TO DOUBLE INVOKED ON INT 17 DMI Vacuous call to collections DMI VACUOUS SELF COLLECTION CALL 集合的調(diào)用不能被感知 例如 c containsAll c 總是返回 true 而 c retainAll c 的返回值不能被感知 18 Dm Can t use reflection to check for presence of annotation without runtime retention DMI ANNOTATION IS NOT VISIBLE TO REFLECTION Unless an annotation has itself been annotated with Retention RetentionPolicy RUNTIME the annotation can t be observed using reflection e g by using the isAnnotationPresent method 19 Dm Useless vacuous call to EasyMock method DMI VACUOUS CALL TO EASYMOCK METHOD While ScheduledThreadPoolExecutor inherits from ThreadPoolExecutor a few of the inherited tuning methods are not useful for it In particular because it acts as a fixed sized pool using corePoolSize threads and an unbounded queue adjustments to maximumPoolSize have no useful effect 20 EC equals used to compare array and nonarray EC ARRAY AND NONARRAY 數(shù)組對(duì)象使用 equals 方法和非數(shù)組對(duì)象進(jìn)行比較 即使比較的雙方都 是數(shù)組對(duì)象也不應(yīng)該使用 equals 方法 而應(yīng)該比較它們的內(nèi)容是否相 等使用 java util Arrays equals Object Object 21 EC equals used to compare incompatible arrays EC INCOMPATIBLE ARRAY COMPARE 使用 equls 方法去比較類型不相同的數(shù)組 例如 String and StringBuffer or String and int 22 EC Call to equals with null argument EC NULL ARG 調(diào)用 equals 的對(duì)象為 null 23 EC Call to equals comparing unrelated class and interface EC UNRELATED CLASS AND INTERFACE 使用 equals 方法比較不相關(guān)的類和接口 24 EC Call to equals comparing different interface types EC UNRELATED INTERFACES 調(diào)用 equals 方法比較不同類型的接口 25 EC Call to equals comparing different types EC UNRELATED TYPES 調(diào)用 equals 方法比較不同類型的類 26 EC Using pointer equality to compare different types EC UNRELATED TYPES USING POINTER EQUALITY This method uses using pointer equality to compare two references that seem to be of different types The result of this comparison will always be false at runtime 27 Eq equals method always returns false EQ ALWAYS FALSE 使用 equals 方法返回值總是 false 28 Eq equals method always returns true EQ ALWAYS TRUE equals 方法返回值總是 true 29 Eq equals method compares class names rather than class objects EQ COMPARING CLASS NAMES 使用 equals 方法去比較一個(gè)類的實(shí)例和類的類型 30 Eq Covariant equals method defined for enum EQ DONT DEFINE EQUALS FOR ENUM This class defines an enumeration and equality on enumerations are defined using object identity Defining a covariant equals method for an enumeration value is exceptionally bad practice since it would likely result in having two different enumeration values that compare as equals using the covariant enum method and as not equal when compared normally Don t do it 31 Eq equals method defined that doesn t override equals Object EQ OTHER NO OBJECT 類中定義的 equals 方法時(shí)不要覆寫 equals Object 方法 32 Eq equals method defined that doesn t override Object equals Object EQ OTHER USE OBJECT 類中定義的 equals 方法時(shí)不要覆寫 Object 中的 equals Object 方 法 33 Eq equals method overrides equals in superclass and may not be symmetric EQ OVERRIDING EQUALS NOT SYMMETRIC 34 Eq Covariant equals method defined Object equals Object inherited EQ SELF USE OBJECT 類中定義了一組 equals 方法 但是都是繼承的 java lang Object class 中的 equals Object 方法 35 FE Doomed test for equality to NaN FE TEST IF EQUAL TO NOT A NUMBER This code checks to see if a floating point value is equal to the special Not A Number value e g if x Double NaN However because of the special semantics of NaN no value is equal to Nan including NaN Thus x Double NaN always evaluates to false To check to see if a value contained in x is the special Not A Number value use Double isNaN x or Float isNaN x if x is floating point precision 36 FS Format string placeholder incompatible with passed argument VA FORMAT STRING BAD ARGUMENT 錯(cuò)誤使用參數(shù)類型來格式化字符串 37 FS The type of a supplied argument doesn t match format specifier VA FORMAT STRING BAD CONVERSION 指定的格式字符串和參數(shù)類型不匹配 例如 String format d 1 38 FS MessageFormat supplied where printf style format expected VA FORMAT STRING EXPECTED MESSAGE FORMAT SUPPLIED 但用 String 的 format 方法時(shí)實(shí)際調(diào)用了 中干的格式化方法而引起格式化結(jié)果出 錯(cuò) 39 FS More arguments are passed than are actually used in the format string VA FORMAT STRING EXTRA ARGUMENTS PASSED 使用 String 的 format 方法時(shí)有非法的參數(shù)也經(jīng)過了格式化操作 40 FS Illegal format string VA FORMAT STRING ILLEGAL 格式化 String 對(duì)象語句錯(cuò)誤 41 FS Format string references missing argument VA FORMAT STRING MISSING ARGUMENT String 的 format 操作缺少必要的參數(shù) 42 FS No previous argument for format string VA FORMAT STRING NO PREVIOUS ARGUMENT 格式字符串定義錯(cuò)誤 例如 formatter format s s a b 拋出 MissingFormatArgumentException 異常 43 GC No relationship between generic parameter and method argument GC UNRELATED TYPES This call to a generic collection method contains an argument with an incompatible class from that of the collection s parameter i e the type of the argument is neither a supertype nor a subtype of the corresponding generic type argument Therefore it is unlikely that the collection contains any objects that are equal to the method argument used here Most likely the wrong value is being passed to the method In general instances of two unrelated classes are not equal For example if the Foo and Bar classes are not related by subtyping then an instance of Foo should not be equal to an instance of Bar Among other issues doing so will likely result in an equals method that is not symmetrical For example if you define the Foo class so that a Foo can be equal to a String your equals method isn t symmetrical since a String can only be equal to a String In rare cases people do define nonsymmetrical equals methods and still manage to make their code work Although none of the APIs document or guarantee it it is typically the case that if you check if a Collection contains a Foo the equals method of argument e g the equals method of the Foo class used to perform the equality checks 44 HE Signature declares use of unhashable class in hashed construct HE SIGNATURE DECLARES HASHING OF UNHASHABLE CLASS A method field or class declares a generic signature where a non hashable class is used in context where a hashable class is required A class that declares an equals method but inherits a hashCode method from Object is unhashable since it doesn t fulfill the requirement that equal objects have equal hashCodes 45 HE Use of class without a hashCode method in a hashed data structure HE USE OF UNHASHABLE CLASS A class defines an equals Object method but not a hashCode method and thus doesn t fulfill the requirement that equal objects have equal hashCodes An instance of this class is used in a hash data structure making the need to fix this problem of highest importance 46 ICAST integral value cast to double and then passed to Math ceil ICAST INT CAST TO DOUBLE PASSED TO CEIL integral 的值轉(zhuǎn)換為 double 后使用了 Math ceil 方法 47 ICAST int value cast to float and then passed to Math round ICAST INT CAST TO FLOAT PASSED TO ROUND int 類型的值轉(zhuǎn)換為 float 類型之后調(diào)用了 Math round 方法 48 IJU JUnit assertion in run method will not be noticed by JUnit IJU ASSERT METHOD INVOKED FROM RUN METHOD 在 JUnit 中的斷言在 run 方法中不會(huì)被告知 49 IJ