The FindBugs™ bug descriptions of the online documentation are concise and well written. Unfortunately, some parts of the descriptions are not easy to understand (even for experienced Java developers). It can be difficult to understand the exact root cause for a warning and/or to find the correct way of fixing.
To be honest – at least I had problems with some warnings in the last years. Quite often I found no helping sample code in the web. The main weakness of the bug descriptions is, that it uses seldom sample code to demonstrate the wrong and correct situation. This is my motivation to publish in the next weeks a series of articles with simple code samples of selected warnings.
The following 10 warnings are covered in this article:
- BC_IMPOSSIBLE_CAST
- BC_IMPOSSIBLE_DOWNCAST
- BC_IMPOSSIBLE_INSTANCEOF
- BC_IMPOSSIBLE_DOWNCAST_OF_TOARRAY
- DMI_BIGDECIMAL_CONSTRUCTED_FROM_DOUBLE
- ES_COMPARING_STRINGS_WITH_EQ
- VA_FORMAT_STRING_ILLEGAL
- RV_RETURN_VALUE_IGNORED NP_ALWAYS_NULL QBA_QUESTIONABLE_BOOLEAN_ASSIGNMENT
The following sample has been compiled with JDK 1.6.0_24 and Findbugs™ (Version 2.0.1-rc2) will show all warnings with the default settings of the Findbugs™ Eclipse Plugin (Version 2.0.1.20120511).
package com.sprunck.samples;
import java.math.BigDecimal;
import java.util.ArrayList;
import java.util.Collection;
import java.util.UnknownFormatConversionException;
@SuppressWarnings(value = { "null", "unused" })
public class FindbugsWarningsBySampleFirst {
public static void main(final String[] args) {
System.out.println("Findbugs Sample 001 for BC_IMPOSSIBLE_CAST");
// WRONG
try {
FindbugsWarningsBySampleFirst.bcImpossibleCastWRONG();
} catch (final ClassCastException e) {
System.out.println(" - ERROR:" + e.getMessage());
}
// CORRECT
FindbugsWarningsBySampleFirst.bcImpossibleCastCORRECT();
System.out.println("Findbugs Sample 002 for BC_IMPOSSIBLE_DOWNCAST");
// WRONG
try {
FindbugsWarningsBySampleFirst.bcImpossibleDowncastWRONG();
} catch (final ClassCastException e) {
System.out.println(" - ERROR:" + e.getMessage());
}
// CORRECT
FindbugsWarningsBySampleFirst.bcImpossibleDowncastCORRECT();
System.out.println("Findbugs Sample 003 for BC_IMPOSSIBLE_INSTANCEOF");
// WRONG
FindbugsWarningsBySampleFirst.bcImpossibleInstanceOfWRONG();
// CORRECT
FindbugsWarningsBySampleFirst.bcImpossibleInstanceOfCORRECT();
System.out.println("Findbugs Sample 004 for BC_IMPOSSIBLE_DOWNCAST_OF_TOARRAY");
// WRONG
try {
FindbugsWarningsBySampleFirst.bcImpossibleDowncastOfArrayWRONG();
} catch (final ClassCastException e) {
System.out.println(" - ERROR:" + e.getMessage());
}
// CORRECT
FindbugsWarningsBySampleFirst.bcImpossibleDowncastOfArrayCORRECT();
System.out.println("Findbugs Sample 005 for DMI_BIGDECIMAL_CONSTRUCTED_FROM_DOUBLE");
// WRONG
FindbugsWarningsBySampleFirst.dmiBigDecimalConstructedFromDoubleWRONG();
// CORRECT
FindbugsWarningsBySampleFirst.dmiBigDecimalConstructedFromDoubleCORRECT();
System.out.println("Findbugs Sample 006 for ES_COMPARING_STRINGS_WITH_EQ");
// WRONG
FindbugsWarningsBySampleFirst.esComparingStringsWithEqWRONG();
// CORRECT
FindbugsWarningsBySampleFirst.esComparingStringsWithEqCORRECT();
System.out.println("Findbugs Sample 007 for VA_FORMAT_STRING_ILLEGAL");
// WRONG
try {
FindbugsWarningsBySampleFirst.vaFormatStringIllegalWRONG();
} catch (final UnknownFormatConversionException e) {
System.out.println(" - ERROR:" + e.getMessage());
}
// CORRECT
FindbugsWarningsBySampleFirst.vaFormatStringIllegalCORRECT();
System.out.println("Findbugs Sample 008 for RV_RETURN_VALUE_IGNORED");
// WRONG
FindbugsWarningsBySampleFirst.rvReturnValueIgnoredWRONG();
// CORRECT
FindbugsWarningsBySampleFirst.rvReturnValueIgnoredCORRECT();
System.out.println("Findbugs Sample 009 for NP_ALWAYS_NULL");
// WRONG
try {
FindbugsWarningsBySampleFirst.npAlwaysNullWRONG();
} catch (final NullPointerException e) {
System.out.println(" - ERROR:" + e.getMessage());
}
// CORRECT
FindbugsWarningsBySampleFirst.npAlwaysNullCORRECT();
System.out.println("Findbugs Sample 010 for QBA_QUESTIONABLE_BOOLEAN_ASSIGNMENT");
// WRONG
FindbugsWarningsBySampleFirst.qabQuestionableBooleanAssignmentWRONG();
// CORRECT
FindbugsWarningsBySampleFirst.qabQuestionableBooleanAssignmentCORRECT();
}
private static void bcImpossibleCastWRONG() {
final Object doubleValue = Double.valueOf(1.0);
final Long value = (Long) doubleValue;
System.out.println(" - " + value);
}
private static void bcImpossibleCastCORRECT() {
final Object doubleValue = Double.valueOf(1.0);
final Double value = (Double) doubleValue;
System.out.println(" - " + value);
}
private static void bcImpossibleDowncastWRONG() {
final Object exception = new RuntimeException("abc");
final SecurityException value = (SecurityException) exception;
System.out.println(" - " + value.getMessage());
}
private static void bcImpossibleDowncastCORRECT() {
final Object exception = new RuntimeException("abc");
final RuntimeException value = (RuntimeException) exception;
System.out.println(" - " + value.getMessage());
}
private static void bcImpossibleInstanceOfWRONG() {
final Object value = Double.valueOf(1.0);
System.out.println(" - " + (value instanceof Long));
}
private static void bcImpossibleInstanceOfCORRECT() {
final Object value = Double.valueOf(1.0);
System.out.println(" - " + (value instanceof Double));
}
private static void bcImpossibleDowncastOfArrayWRONG() {
final Collection<String> stringVector = new ArrayList<String>();
stringVector.add("abc");
stringVector.add("xyz");
final String[] stringArray = (String[]) stringVector.toArray();
System.out.println(" - " + stringArray.length);
}
private static void bcImpossibleDowncastOfArrayCORRECT() {
final Collection<String> stringVector = new ArrayList<String>();
stringVector.add("abc");
stringVector.add("xyz");
final String[] stringArray = stringVector.toArray(new String[stringVector.size()]);
System.out.println(" - " + stringArray.length);
}
private static void dmiBigDecimalConstructedFromDoubleWRONG() {
final BigDecimal bigDecimal = new BigDecimal(3.1);
System.out.println(" - " + bigDecimal.toString());
}
private static void dmiBigDecimalConstructedFromDoubleCORRECT() {
final BigDecimal bigDecimal = new BigDecimal("3.1");
System.out.println(" - " + bigDecimal.toString());
}
private static void esComparingStringsWithEqWRONG() {
final StringBuilder sb1 = new StringBuilder("1234");
final StringBuilder sb2 = new StringBuilder("1234");
final String string1 = sb1.toString();
final String string2 = sb2.toString();
System.out.println(" - " + (string1 == string2));
}
private static void esComparingStringsWithEqCORRECT() {
final StringBuilder sb1 = new StringBuilder("1234");
final StringBuilder sb2 = new StringBuilder("1234");
final String string1 = sb1.toString();
final String string2 = sb2.toString();
System.out.println(" - " + string1.equals(string2));
}
private static void vaFormatStringIllegalWRONG() {
System.out.println(String.format(" - %>s %s", "10", "9"));
}
private static void vaFormatStringIllegalCORRECT() {
System.out.println(String.format(" - %s > %s", "10", "9"));
}
private static void rvReturnValueIgnoredWRONG() {
final BigDecimal bigDecimal = BigDecimal.ONE;
bigDecimal.add(BigDecimal.ONE);
System.out.println(String.format(" - " + bigDecimal));
}
private static void rvReturnValueIgnoredCORRECT() {
final BigDecimal bigDecimal = BigDecimal.ONE;
final BigDecimal newValue = bigDecimal.add(BigDecimal.ONE);
System.out.println(String.format(" - " + newValue));
}
private static void npAlwaysNullWRONG() {
final String value = null;
if (null != value & value.length() > 2) {
System.out.println(String.format(" - " + value));
} else {
System.out.println(String.format(" - value is invalid"));
}
}
private static void npAlwaysNullCORRECT() {
final String value = null;
if (null != value && value.length() > 2) {
System.out.println(String.format(" - " + value));
} else {
System.out.println(String.format(" - value is invalid"));
}
}
private static void qabQuestionableBooleanAssignmentWRONG() {
boolean value = false;
if (value = true) {
System.out.println(String.format(" - value is true"));
} else {
System.out.println(String.format(" - value is false"));
}
}
private static void qabQuestionableBooleanAssignmentCORRECT() {
final boolean value = false;
if (value == true) {
System.out.println(String.format(" - value is true"));
} else {
System.out.println(String.format(" - value is false"));
}
}
}
The program should print the following output to the standard output:
Findbugs Sample 001 for BC_IMPOSSIBLE_CAST - ERROR:java.lang.Double cannot be cast to java.lang.Long - 1.0 Findbugs Sample 002 for BC_IMPOSSIBLE_DOWNCAST - ERROR:java.lang.RuntimeException cannot be cast to java.lang.SecurityException - abc Findbugs Sample 003 for BC_IMPOSSIBLE_INSTANCEOF - false - true Findbugs Sample 004 for BC_IMPOSSIBLE_DOWNCAST_OF_TOARRAY - ERROR:[Ljava.lang.Object; cannot be cast to [Ljava.lang.String; - 2 Findbugs Sample 005 for DMI_BIGDECIMAL_CONSTRUCTED_FROM_DOUBLE - 3.100000000000000088817841970012523233890533447265625 - 3.1 Findbugs Sample 006 for ES_COMPARING_STRINGS_WITH_EQ - false - true Findbugs Sample 007 for VA_FORMAT_STRING_ILLEGAL - ERROR:Conversion = '>' - 10 > 9 Findbugs Sample 008 for RV_RETURN_VALUE_IGNORED - 1 - 2 Findbugs Sample 009 for NP_ALWAYS_NULL - ERROR:null - value is invalid Findbugs Sample 010 for QBA_QUESTIONABLE_BOOLEAN_ASSIGNMENT - value is true - value is false
Please, do not hesitate to contact me if you have any ideas for improvement and/or you find a bug in the sample code.
We continue with the following 5 warnings :
- DMI_CONSTANT_DB_PASSWORD (Security)
- DMI_EMPTY_DB_PASSWORD (Security)
- SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE (Security)
- OBL_UNSATISFIED_OBLIGATION (Experimental)
- OBL_UNSATISFIED_OBLIGATION_EXCEPTION_EDGE (Experimental)
Motivation for the ‘Findbugs™ Warnings By Sample’ Series
The FindBugs™ bug descriptions of the online documentation are concise and well written. Unfortunately, some parts of the descriptions are not easy to understand (even for experienced Java developers). It can be difficult to understand the exact root cause for a warning and/or to find the correct way of fixing.
To be honest – at least I had problems with some warnings in the last years. Quite often I found no helping sample code in the web. The main weakness of the bug descriptions is, that it uses seldom sample code to demonstrate the wrong and correct situation. This is my motivation to publish in the next weeks a series of articles with simple code samples of selected warnings.
Sample Code
Findbugs™ (Version 2.0.1-rc2) will show all warnings with the activated settings ‘Security’ and ‘Experimental’ of the Findbugs™ Eclipse Plugin (Version 2.0.1.20120511). See the following figure:
The sample has been compiled with JDK 1.6.0_24 and with derby.jar (Version 10.9.1.0) in the build path.
package com.sprunck.samples;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
public class FindbugsWarningsBySampleSecond {
public static void main(final String[] args) {
// Prepare database
Statement createStatement = null;
Connection connection = null;
try {
System.out.println("Findbugs Sample prepare small in memory database");
connection = getConnection_dmiConstantDbPasswordCORRECT();
createStatement = connection.createStatement();
createStatement.execute("create table T_ADVICE (answer varchar(255), "
+ "owner varchar(255))");
createStatement.execute("insert into T_ADVICE ( answer, owner ) values "
+ "('Don''t Panic', 'Joe')");
createStatement.execute("insert into T_ADVICE ( answer, owner ) values "
+ "('Keep Smiling', 'John')");
System.out.println("\nFindbugs Sample for DMI_CONSTANT_DB_PASSWORD");
// WRONG
FindbugsWarningsBySampleSecond.getConnection_dmiConstantDbPasswordWRONG();
// CORRECT
FindbugsWarningsBySampleSecond.getConnection_dmiConstantDbPasswordCORRECT();
System.out.println("\nFindbugs Sample for DMI_EMPTY_DB_PASSWORD");
// WRONG
FindbugsWarningsBySampleSecond.getConnection_dmiEmptyDbPasswordWRONG();
// CORRECT
FindbugsWarningsBySampleSecond.getConnection_dmiConstantDbPasswordCORRECT();
System.out.println("\nFindbugs Sample for SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE");
// WRONG
FindbugsWarningsBySampleSecond.sqlNonconstantStringPassedToExecuteWRONG("Joe");
// CORRECT
FindbugsWarningsBySampleSecond.sqlNonconstantStringPassedToExecuteCORRECT("Joe");
System.out.println("\nFindbugs Sample for OBL_UNSATISFIED_OBLIGATION");
// WRONG
FindbugsWarningsBySampleSecond.oblUnsatisfiedObligationWRONG("Joe");
// CORRECT
FindbugsWarningsBySampleSecond.oblUnsatisfiedObligationCORRECT("Joe");
System.out.println("\nFindbugs Sample for OBL_UNSATISFIED_OBLIGATION_EXCEPTION_EDGE");
// WRONG
FindbugsWarningsBySampleSecond.oblUnsatisfiedObligationExceptionEdgeWRONG("Joe");
// CORRECT
FindbugsWarningsBySampleSecond.oblUnsatisfiedObligationExceptionEdgeCORRECT("Joe");
} catch (final SQLException e) {
System.out.println(" - ERROR:" + e.getMessage());
} finally {
if (null != createStatement) {
try {
createStatement.close();
} catch (final SQLException e) {
}
}
if (null != connection) {
try {
connection.close();
} catch (final SQLException e) {
}
}
}
}
private static Connection getConnection_dmiConstantDbPasswordWRONG() throws SQLException {
Connection connection = null;
try {
Class.forName("org.apache.derby.jdbc.EmbeddedDriver");
} catch (final ClassNotFoundException e) {
System.out.println(" - ERROR:" + e.getMessage());
}
connection = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "APP",
"my-secret-password");
System.out.println(" - DriverManager.getConnection(\"jdbc:derby:database;"
+ "create=true\", \"test\", \"admin\"))");
return connection;
}
private static Connection getConnection_dmiEmptyDbPasswordWRONG() throws SQLException {
Connection connection = null;
try {
Class.forName("org.apache.derby.jdbc.EmbeddedDriver");
} catch (final ClassNotFoundException e) {
System.out.println(" - ERROR:" + e.getMessage());
}
connection = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "APP", "");
System.out.println(" - DriverManager.getConnection(\"jdbc:derby:database;create=true\","
+ " \"test\", \"\"))");
return connection;
}
private static Connection getConnection_dmiConstantDbPasswordCORRECT() throws SQLException {
Connection connection = null;
try {
Class.forName("org.apache.derby.jdbc.EmbeddedDriver");
} catch (final ClassNotFoundException e) {
System.out.println(" - ERROR:" + e.getMessage());
}
connection = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "APP",
getSecurePassword());
System.out.println(" - DriverManager.getConnection(\"jdbc:derby:database;"
+ "create=true\", \"test\", pwdDecoder()))");
return connection;
}
static String getSecurePassword() {
// Here we should fetch and decode the password from a secured resource
return "my-sec" + "ret-password";
}
private static void sqlNonconstantStringPassedToExecuteWRONG(final String owner) {
Statement statement = null;
ResultSet resultSet = null;
try {
final String query = "SELECT answer FROM T_ADVICE WHERE owner= '" + owner + "'";
statement = getConnection_dmiConstantDbPasswordCORRECT().createStatement();
resultSet = statement.executeQuery(query);
while (resultSet.next()) {
System.out.println(" - Result (Statement):" + resultSet.getString("ANSWER"));
}
} catch (final SQLException e) {
System.out.println(" - ERROR:" + e.getMessage());
} finally {
if (null != resultSet) {
try {
resultSet.close();
} catch (final SQLException e) {
}
}
if (null != statement) {
try {
statement.close();
} catch (final SQLException e) {
}
}
}
}
private static void sqlNonconstantStringPassedToExecuteCORRECT(final String owner) {
PreparedStatement statement = null;
ResultSet resultSet = null;
try {
final String query = "SELECT answer FROM T_ADVICE WHERE owner = ?";
statement = getConnection_dmiConstantDbPasswordCORRECT().prepareStatement(query);
statement.setString(1, owner);
resultSet = statement.executeQuery();
while (resultSet.next()) {
System.out.println(" - Result (PreparedStatement):"
+ resultSet.getString("ANSWER"));
}
} catch (final SQLException e) {
System.out.println(" - ERROR:" + e.getMessage());
} finally {
if (null != resultSet) {
try {
resultSet.close();
} catch (final SQLException e) {
}
}
if (null != statement) {
try {
statement.close();
} catch (final SQLException e) {
}
}
}
}
private static void oblUnsatisfiedObligationWRONG(final String owner) {
PreparedStatement statement = null;
ResultSet resultSet = null;
try {
final String query = "SELECT answer FROM T_ADVICE WHERE owner = ?";
statement = getConnection_dmiConstantDbPasswordCORRECT().prepareStatement(query);
statement.setString(1, owner);
resultSet = statement.executeQuery();
while (resultSet.next()) {
System.out.println(" - Result (PreparedStatement):"
+ resultSet.getString("ANSWER"));
}
} catch (final SQLException e) {
System.out.println(" - ERROR:" + e.getMessage());
} finally {
if (null != statement) {
try {
statement.close();
} catch (final SQLException e) {
}
}
}
}
private static void oblUnsatisfiedObligationCORRECT(final String owner) {
PreparedStatement statement = null;
ResultSet resultSet = null;
try {
final String query = "SELECT answer FROM T_ADVICE WHERE owner = ?";
statement = getConnection_dmiConstantDbPasswordCORRECT().prepareStatement(query);
statement.setString(1, owner);
resultSet = statement.executeQuery();
while (resultSet.next()) {
System.out.println(" - Result (PreparedStatement):"
+ resultSet.getString("ANSWER"));
}
} catch (final SQLException e) {
System.out.println(" - ERROR:" + e.getMessage());
} finally {
if (null != resultSet) {
try {
resultSet.close();
} catch (final SQLException e) {
}
}
if (null != statement) {
try {
statement.close();
} catch (final SQLException e) {
}
}
}
}
private static void oblUnsatisfiedObligationExceptionEdgeWRONG(final String owner) {
PreparedStatement statement = null;
ResultSet resultSet = null;
try {
final String query = "SELECT answer FROM T_ADVICE WHERE owner = ?";
statement = getConnection_dmiConstantDbPasswordCORRECT().prepareStatement(query);
statement.setString(1, owner);
resultSet = statement.executeQuery();
while (resultSet.next()) {
System.out.println(" - Result (PreparedStatement):"
+ resultSet.getString("ANSWER"));
}
if (null != statement) {
try {
statement.close();
} catch (final SQLException e) {
}
}
} catch (final SQLException e) {
System.out.println(" - ERROR:" + e.getMessage());
} finally {
if (null != resultSet) {
try {
resultSet.close();
} catch (final SQLException e) {
}
}
}
}
private static void oblUnsatisfiedObligationExceptionEdgeCORRECT(final String owner) {
PreparedStatement statement = null;
ResultSet resultSet = null;
try {
final String query = "SELECT answer FROM T_ADVICE WHERE owner = ?";
statement = getConnection_dmiConstantDbPasswordCORRECT().prepareStatement(query);
statement.setString(1, owner);
resultSet = statement.executeQuery();
while (resultSet.next()) {
System.out.println(" - Result (PreparedStatement):"
+ resultSet.getString("ANSWER"));
}
if (null != statement) {
try {
statement.close();
} catch (final SQLException e) {
}
}
} catch (final SQLException e) {
System.out.println(" - ERROR:" + e.getMessage());
} finally {
if (null != resultSet) {
try {
resultSet.close();
} catch (final SQLException e) {
}
}
if (null != statement) {
try {
statement.close();
} catch (final SQLException e) {
}
}
}
}
}
The program should print the following output to the standard output:
Findbugs Sample prepare small in memory database
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", pwdDecoder()))
Findbugs Sample for DMI_CONSTANT_DB_PASSWORD
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", "admin"))
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", pwdDecoder()))
Findbugs Sample for DMI_EMPTY_DB_PASSWORD
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", ""))
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", pwdDecoder()))
Findbugs Sample for SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", pwdDecoder()))
- Result (Statement):Don't Panic
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", pwdDecoder()))
- Result (PreparedStatement):Don't Panic
Findbugs Sample for OBL_UNSATISFIED_OBLIGATION
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", pwdDecoder()))
- Result (PreparedStatement):Don't Panic
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", pwdDecoder()))
- Result (PreparedStatement):Don't Panic
Findbugs Sample for OBL_UNSATISFIED_OBLIGATION_EXCEPTION_EDGE
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", pwdDecoder()))
- Result (PreparedStatement):Don't Panic
- DriverManager.getConnection("jdbc:derby:database;create=true", "test", pwdDecoder()))
- Result (PreparedStatement):Don't Panic
Please, do not hesitate to contact me if you have any ideas for improvement and/or you find a bug in the sample code.
Reference: Findbugs™ Warnings By Sample – Part I, Findbugs™ Warnings By Sample – Part IIfrom our JCG partner Markus Sprunck at the Software Engineering Candies blog.
