Lab 5
Static Analysis
Static analysis of software refers to all those analyses that are performed on a software product without actually executing the code. Some of the best known and widely used static analysis tools for Java are FindBugs, PMD and Checkstyle. All these are programs used to find potential bugs in Java software, by looking for specific bug patterns (FindBugs and PMD), or enforcing specific coding, formatting and design standards (Checkstyle). They are often included in the ant/maven/gradle build and run as part of Continous Integration / Continous Delivery pipeline.
FindBugs
FindBugs is a static analysis tool that finds various specific flaws in Java code.
We will download FindBugs from here
Our goal will be to analyze the JUnit 4 code. We therefore save JUnit 4.5 jar and JUnit 4.5 source code jar (jar extensions renamed as .zip due to wiki upload constraints)
Please note that FindBugs needs the bytecode files (the compiled .class files) in order to perform its analyses.
Run FindBugs, fill in the name of the archive containing the compiled bytecode files, and the name of the archive containing the source code.
Take a look at, and analyze the bug categories there. Discuss.
For eclipse version later than 4.6 please use SpotBugs.
The FindBugs Eclipse plugin
Please save the archive with the project to analyze (JUnit), then import the project in Eclipse.
Install the FindBugs plugin to Eclipse by using the menu Help->Software Updates>Find and install...->Search New Features->New Remote Site, then fill in the form as follows: Name: FindBugs, URL: http://findbugs.cs.umd.edu/eclipse/ then -> OK -> Finish. Select then FindBugs and run the plugin installation.
You can now take a look at the FindBugs section within the contextual menu (which opens by right-click) of the analized Eclipse project.
Run FindBugs on your project and look for the files where several issues are found. In order to do this, open view Bug tree View from the menu Window->Show View->Other->FindBugs
For more details on FindBugs please also check the various resource available here
Static analysis with clang