FindBugs错误修改中文说明大全

FindBug 错误修改中文说明大全 复制你的 Pattern id 然后用 Ctrl F 快速查找定位 Security 关于代码安全性防护 序号 Description 备注 1 Dm Hardcoded constant database password DMI CONSTANT DB PASSWORD 代码中创建 DB 的密码时采用了写死的密码 2 Dm Empty database password DMI EMPTY DB PASSWORD 创建数据库连接时没有为数据库设置密码 这会使数据库没有 必要的保护 3 HRS HTTP cookie formed from untrusted input HRS REQUEST PARAMETER TO COOKIE 此代码使用不受信任的 HTTP 参数构造一个 HTTP Cookie 4 HRS HTTP Response splitting vulnerability HRS REQUEST PARAMETER TO HTTP HEADER 在代码中直接把一个 HTTP 的参数写入一个 HTTP 头文件中 它为 HTTP 的响应暴露了漏洞 5 SQL Nonconstant string passed to execute method on an SQL statement SQL NONCONSTANT STRING PASSED TO EXECUTE 该方法以字符串的形式来调用 SQLstatement 的 execute 方法 它似乎是动态生成 SQL 语句的方法 这会更容易受到 SQL 注 入攻击 6 XSS JSP reflected cross site scripting vulnerability XSS REQUEST PARAMETER TO JSP WRITER 在代码中在 JSP 输出中直接写入一个 HTTP 参数 这会造成一 个跨站点的脚本漏洞 Experimental 序号 Description 备注 1 LG Potential lost logger changes due to weak reference in OpenJDK LG LOST LOGGER DUE TO WEAK REFERENCE OpenJDK 的引入了一种潜在的不兼容问题 特别是 java util logging Logger 的行为改变时 它现在使用 内部弱引用 而不是强引用 logger 配置改变 它 就是丢失对 logger 的引用 这本是一个合理的变化 但不幸的是一些代码对旧的行为有依赖关系 这意味 着 当进行垃圾收集时对 logger 配置将会丢失 例如 public static void initLogging throws Exception Logger logger Logger getLogger edu umd cs logger addHandler new FileHandler call to change logger configuration logger setUseParentHandlers false another call to change logger configuration 该方法结束时 logger 的引用就丢失了 如果你刚刚结 束调用 initLogging 方法后进行垃圾回收 logger 的 配置将会丢失 因为只有保持记录器弱引用 public static void main String args throws Exception initLogging adds a file handler to the logger System gc logger configuration lost Logger getLogger edu umd cs info Some message this isn t logged to the file as expected 2 OBL Method may fail to clean up stream or resource OBL UNSATISFIED OBLIGATION 这种方法可能无法清除 关闭 处置 一个流 数据 库对象 或其他资源需要一个明确的清理行动 一般来说 如果一个方法打开一个流或其他资源 该 方法应该使用 try finally 块来确保在方法返回之前流 或资源已经被清除了 这种错误模式基本上和 OS OPEN STREAM 和 ODR OPEN DATABASE RESOURCE 错误模式相同 但是是在不同在静态分析技术 我们正为这个错误模 式的效用收集反馈意见 Bad practice 代码实现中的一些坏习惯 序 号 Description 备 注 1 AM Creates an empty jar file entry AM CREATES EMPTY JAR FILE ENTRY 调用 putNextEntry 方法写入新的 jar 文件条目时立即调用 closeEntry 方法 这样会造成 JarFile 条目为空 2 AM Creates an empty zip file entry AM CREATES EMPTY ZIP FILE ENTRY 调用 putNextEntry 方法写入新的 zip 文件条目时立即调用 closeEntry 方法 这样会造成 ZipFile 条目为空 3 BC Equals method should not assume anything about the type of its argument BC EQUALS METHOD SHOULD WORK FOR ALL OBJECTS equals Object o 方法不能对参数 o 的类型做任何的假设 比较此 对象与指定的对象 当且仅当该参数不为 null 并且是表示与此对 象相同的类型的对象时 结果才为 true 4 BC Random object created and used only once DMI RANDOM USED ONLY ONCE 随机创建对象只使用过一次就抛弃 5 BIT Check for sign of bitwise operation BIT SIGNED CHECK 检查位操作符运行是否合理 event detail else if o instanceof String return name equals o else return false 21 Eq Class defines compareTo and uses Object equals EQ COMPARETO USE OBJECT EQUALS 类中定义了 compareTo 方法但是继承了 Object 中的 compareTo 方法 22 Eq equals method fails for subtypes EQ GETCLASS AND CLASS CONSTANT 类中的 equals 方法可能被子类中的方法所破坏 当使用类似于 Foo class o getClass 的判断时考虑用 this getClass o getClass 来替换 23 Eq Covariant equals method defined EQ SELF NO OBJECT 类中定义了多个 equals 方法 正确的做法是覆写 Object 中的 equals 方法 它的参数为 Object 类型的对象 24 FI Empty finalizer should be deleted FI EMPTY 为空的 finalizer 方法应该删除 一下关于 finalizer 的内容省略 25 GC Unchecked type in generic call GC UNCHECKED TYPE IN GENERIC CALL This call to a generic collection method passes an argument while compile type Object where a specific type from the generic type parameters is expected Thus neither the standard Java type system nor static analysis can provide useful information on whether the object being passed as a parameter is of an appropriate type 26 HE Class defines equals but not hashCode HE EQUALS NO HASHCODE 方法定义了 equals 方法却没有定义 hashCode 方法 27 HE Class defines hashCode but not equals HE HASHCODE NO EQUALS 类定义了 hashCode 方法去没有定义 equal 方法 28 HE Class defines equals and uses Object hashCode HE EQUALS USE HASHCODE 一个类覆写了 equals 方法 没有覆写 hashCode 方法 使用了 Object 对象的 hashCode 方法 29 HE Class inherits equals and uses Object hashCode HE INHERITS EQUALS USE HASHCODE 子类继承了父类的 equals 方法却使用了 Object 的 hashCode 方法 30 IC Superclass uses subclass during initialization IC SUPERCLASS USES SUBCLASS DURING INITIALIZATION 子类在父类未初始化之前使用父类对象实例 public class CircularClassInitialization static class InnerClassSingleton extends CircularClassInitialization static InnerClassSingleton singleton new InnerClassSingleton static CircularClassInitialization foo InnerClassSingleton singleton 31 IMSE Dubious catching of IllegalMonitorStateException IMSE DONT CATCH IMSE 捕捉违法的监控状态异常 例如当没有获取到对象锁时使用其 wait 和 notify 方法 32 ISC Needless instantiation of class that only supplies static methods ISC INSTANTIATE STATIC CLASS 为使用静态方法而创建一个实例对象 调用静态方法时只需要使用 类名 静态方法名就可以了 33 It Iterator next method can t throw NoSuchElementException IT NO SUCH ELEMENT 迭代器的 next 方法不能够抛出 NoSuchElementException 34 J2EE Store of non serializable object into HttpSession J2EE STORE OF NON SERIALIZABLE OBJECT INTO SESSION 在 HttpSession 对象中保存非连续的对象 35 JCIP Fields of immutable classes should be final JCIP FIELD ISNT FINAL IN IMMUTABLE CLASS The class is annotated with net jcip annotations Immutable and the rules for that annotation require that all fields are final 36 NP Method with Boolean return type returns explicit null NP BOOLEAN RETURN NULL 返回值为 boolean 类型的方法直接返回 null 这样会导致空指针异 常 37 NP equals method does not check for null argument NP EQUALS SHOULD HANDLE NULL ARGUMENT 变量调用 equals 方法时没有进行是否为 null 的判断 38 NP toString method may return null NP TOSTRING COULD RETURN NULL toString 方法可能返回 null 39 Nm Class names should start with an upper case letter NM CLASS NAMING CONVENTION 类的名称以大写字母名称开头 40 Nm Class is not derived from an Exception even though it is named as such NM CLASS NOT EXCEPTION 类的名称中含有 Exception 但是却不是一个异常类的子类 这种名 称会造成混淆 41 Nm Confusing method names NM CONFUSING 令人迷惑的方面命名 42 Nm Field names should start with a lower case letter NM FIELD NAMING CONVENTION 非 final 类型的字段需要遵循驼峰命名原则 43 Nm Use of identifier that is a keyword in later versions of Java NM FUTURE KEYWORD USED AS IDENTIFIER 验证是否是 java 预留关键字 44 Nm Use of identifier that is a keyword in later versions of Java NM FUTURE KEYWORD USED AS MEMBER IDENTIFIER 验证是否时 java 中的关键字 45 Nm Method names should start with a lower case letter NM METHOD NAMING CONVENTION 方法名称以小写字母开头 46 Nm Class names shouldn t shadow simple name of implemented interface NM SAME SIMPLE NAME AS INTERFACE 实现同一接口实现类不能使用相同的名称 即使它们位于不同的包 中 47 Nm Class names shouldn t shadow simple name of superclass NM SAME SIMPLE NAME AS SUPERCLASS 继承同一父类的子类不能使用相同的名称 即使它们位于不同的包 中 48 Nm Very confusing method names but perhaps intentional NM VERY CONFUSING INTENTIONAL 很容易混淆的方法命名 例如方法的名称名称使用使用大小写来区 别两个不同的方法 49 Nm Method doesn t override method in superclass due to wrong package for parameter NM WRONG PACKAGE INTENTIONAL 由于错误引用了不同包中相同类名的对象而不能够正确的覆写父类 中的方法 import alpha Foo public class A public int f Foo x return 17 import beta Foo public class B extends A public int f Foo x return 42 public int f alpha Foo x return 27 50 ODR Method may fail to close database resource ODR OPEN DATABASE RESOURCE 方法中可能存在关闭数据连接失败的情况 51 OS Method may fail to close stream OS OPEN STREAM 方法中可能存在关闭流失败的情况 52 OS Method may fail to close stream on exception OS OPEN STREAM EXCEPTION PATH 方法中可能存在关闭流时出现异常情况 53 RC Suspicious reference comparison to constant RC REF COMPARISON BAD PRACTICE 当两者为不同类型的对象时使用 equals 方法来比较它们的值是否相 等 而不是使用 方法 例如比较的两者为 java lang Integer java lang Float 54 RC Suspicious reference comparison of Boolean values RC REF COMPARISON BAD PRACTICE BOOLEAN 使用 或者 操作符来比较两个 Boolean 类型的对象 建议使 用 equals 方法 55 RR Method ignores results of InputStream read RR NOT CHECKED InputStream read 方法忽略返回的多个字符 如果对结果没有检查 就没法正确处理用户读取少量字符请求的情况 56 RR Method ignores results of InputStream skip SR NOT CHECKED InputStream skip 方法忽略返回的多个字符 如果对结果没有检查 就没法正确处理用户跳过少量字符请求的情况 57 RV Method ignores exceptional return value RV RETURN VALUE IGNORED BAD PRACTICE 方法忽略返回值的异常信息 58 SI Static initializer creates instance before all static final fields assigned SI INSTANCE BEFORE FINALS ASSIGNED 在所有的 static final 字段赋值之前去使用静态初始化的方法创建一 个类的实例 59 Se Non serializable value stored into instance field of a serializable class SE BAD FIELD STORE 非序列化的值保存在声明为序列化的的非序列化字段中 60 Se Comparator doesn t implement Serializable SE COMPARATOR SHOULD BE SERIALIZABLE Comparator 接口没有实现 Serializable 接口 61 Se Serializable inner class SE INNER CLASS 序列化内部类 62 Se serialVersionUID isn t final SE NONFINAL SERIALVERSIONID 关于 UID 类的检查内容省略 63 Se Class is Serializable but its superclass doesn t define a void constructor SE NO SUITABLE CONSTRUCTOR 子类序列化时父类没有提供一个 void 的构造函数 64 Se Class is Externalizable but doesn t define a void constructor SE NO SUITABLE CONSTRUCTOR FOR EXTERNALIZATION Externalizable 实例类没有定义一个 void 类型的构造函数 65 Se The readResolve method must be declared with a return type of Object SE READ RESOLVE MUST RETURN OBJECT readResolve 从流中读取类的一个实例 此方法必须声明返回一个 Object 类型的对象 66 Se Transient field that isn t set by deserialization SE TRANSIENT FIELD NOT RESTORED This class contains a field that is updated at multiple places in the class thus it seems to be part of the state of the class However since the field is marked as transient and not set in readObject or readResolve it will contain the default value in any deserialized instance of the class 67 SnVI Class is Serializable but doesn t define serialVersionUID SE NO SERIALVERSIONID 一个类实现了 Serializable 接口但是没有定义 serialVersionUID 类 型的变量 序列化运行时使用一个称为 serialVersionUID 的版本 号与每个可序列化类相关联 该序列号在反序列化过程中用于验证 序列化对象的发送者和接收者是否为该对象加载了与序列化兼容的 类 如果接收者加载的该对象的类的 serialVersionUID 与对应的 发送者的类的版本号不同 则反序列化将会导致 InvalidClassException 可序列化类可以通过声明名为 serialVersionUID 的字段 该字段必须是静态 static 最终 final 的 long 型字段 显式声明其自己的 serialVersionUID ANY ACCESS MODIFIER static final long serialVersionUID 42L 68 UI Usage of GetResource may be unsafe if class is extended UI INHERITANCE UNSAFE GETRESOURCE 当一个类被子类继承后不要使用 this getClass getResource 来 获取资源 Correctness 关于代码正确性相关方面的 序 号 Description 备 注 1 BC Impossible cast BC IMPOSSIBLE CAST 不可能的类转换 执行时会抛出 ClassCastException 2 BC Impossible downcast BC IMPOSSIBLE DOWNCAST 父类在向下进行类型转换时抛出 ClassCastException 3 BC Impossible downcast of toArray result BC IMPOSSIBLE DOWNCAST OF TOARRAY 集合转换为数组元素时发生的类转换错误 This code is casting the result of calling toArray on a collection to a type more specific than Object as in String getAsArray Collection c return String c toArray This will usually fail by throwing a ClassCastException The toArray of almost all collections return an Object They can t really do anything else since the Collection object has no reference to the declared generic type of the collection The correct way to do get an array of a specific type from a collection is to use c toArray new String or c toArray new String c size the latter is slightly more efficient 4 BC instanceof will always return false BC IMPOSSIBLE INSTANCEOF 采用 instaneof 方法进行比较时总是返回 false 前提是保证它不是由 于某些逻辑错误造成的 5 BIT Incompatible bit masks BIT AND 错误的使用 System out println a1 hashCode System out println java util Arrays hashCode a1 16 DMI Double longBitsToDouble invoked on an int DMI LONG BITS TO DOUBLE INVOKED ON INT 17 DMI Vacuous call to collections DMI VACUOUS SELF COLLECTION CALL 集合的调用不能被感知 例如 c containsAll c 总是返回 true 而 c retainAll c 的返回值不能被感知 18 Dm Can t use reflection to check for presence of annotation without runtime retention DMI ANNOTATION IS NOT VISIBLE TO REFLECTION Unless an annotation has itself been annotated with Retention RetentionPolicy RUNTIME the annotation can t be observed using reflection e g by using the isAnnotationPresent method 19 Dm Useless vacuous call to EasyMock method DMI VACUOUS CALL TO EASYMOCK METHOD While ScheduledThreadPoolExecutor inherits from ThreadPoolExecutor a few of the inherited tuning methods are not useful for it In particular because it acts as a fixed sized pool using corePoolSize threads and an unbounded queue adjustments to maximumPoolSize have no useful effect 20 EC equals used to compare array and nonarray EC ARRAY AND NONARRAY 数组对象使用 equals 方法和非数组对象进行比较 即使比较的双方都 是数组对象也不应该使用 equals 方法 而应该比较它们的内容是否相 等使用 java util Arrays equals Object Object 21 EC equals used to compare incompatible arrays EC INCOMPATIBLE ARRAY COMPARE 使用 equls 方法去比较类型不相同的数组 例如 String and StringBuffer or String and int 22 EC Call to equals with null argument EC NULL ARG 调用 equals 的对象为 null 23 EC Call to equals comparing unrelated class and interface EC UNRELATED CLASS AND INTERFACE 使用 equals 方法比较不相关的类和接口 24 EC Call to equals comparing different interface types EC UNRELATED INTERFACES 调用 equals 方法比较不同类型的接口 25 EC Call to equals comparing different types EC UNRELATED TYPES 调用 equals 方法比较不同类型的类 26 EC Using pointer equality to compare different types EC UNRELATED TYPES USING POINTER EQUALITY This method uses using pointer equality to compare two references that seem to be of different types The result of this comparison will always be false at runtime 27 Eq equals method always returns false EQ ALWAYS FALSE 使用 equals 方法返回值总是 false 28 Eq equals method always returns true EQ ALWAYS TRUE equals 方法返回值总是 true 29 Eq equals method compares class names rather than class objects EQ COMPARING CLASS NAMES 使用 equals 方法去比较一个类的实例和类的类型 30 Eq Covariant equals method defined for enum EQ DONT DEFINE EQUALS FOR ENUM This class defines an enumeration and equality on enumerations are defined using object identity Defining a covariant equals method for an enumeration value is exceptionally bad practice since it would likely result in having two different enumeration values that compare as equals using the covariant enum method and as not equal when compared normally Don t do it 31 Eq equals method defined that doesn t override equals Object EQ OTHER NO OBJECT 类中定义的 equals 方法时不要覆写 equals Object 方法 32 Eq equals method defined that doesn t override Object equals Object EQ OTHER USE OBJECT 类中定义的 equals 方法时不要覆写 Object 中的 equals Object 方 法 33 Eq equals method overrides equals in superclass and may not be symmetric EQ OVERRIDING EQUALS NOT SYMMETRIC 34 Eq Covariant equals method defined Object equals Object inherited EQ SELF USE OBJECT 类中定义了一组 equals 方法 但是都是继承的 java lang Object class 中的 equals Object 方法 35 FE Doomed test for equality to NaN FE TEST IF EQUAL TO NOT A NUMBER This code checks to see if a floating point value is equal to the special Not A Number value e g if x Double NaN However because of the special semantics of NaN no value is equal to Nan including NaN Thus x Double NaN always evaluates to false To check to see if a value contained in x is the special Not A Number value use Double isNaN x or Float isNaN x if x is floating point precision 36 FS Format string placeholder incompatible with passed argument VA FORMAT STRING BAD ARGUMENT 错误使用参数类型来格式化字符串 37 FS The type of a supplied argument doesn t match format specifier VA FORMAT STRING BAD CONVERSION 指定的格式字符串和参数类型不匹配 例如 String format d 1 38 FS MessageFormat supplied where printf style format expected VA FORMAT STRING EXPECTED MESSAGE FORMAT SUPPLIED 但用 String 的 format 方法时实际调用了 中干的格式化方法而引起格式化结果出 错 39 FS More arguments are passed than are actually used in the format string VA FORMAT STRING EXTRA ARGUMENTS PASSED 使用 String 的 format 方法时有非法的参数也经过了格式化操作 40 FS Illegal format string VA FORMAT STRING ILLEGAL 格式化 String 对象语句错误 41 FS Format string references missing argument VA FORMAT STRING MISSING ARGUMENT String 的 format 操作缺少必要的参数 42 FS No previous argument for format string VA FORMAT STRING NO PREVIOUS ARGUMENT 格式字符串定义错误 例如 formatter format s s a b 抛出 MissingFormatArgumentException 异常 43 GC No relationship between generic parameter and method argument GC UNRELATED TYPES This call to a generic collection method contains an argument with an incompatible class from that of the collection s parameter i e the type of the argument is neither a supertype nor a subtype of the corresponding generic type argument Therefore it is unlikely that the collection contains any objects that are equal to the method argument used here Most likely the wrong value is being passed to the method In general instances of two unrelated classes are not equal For example if the Foo and Bar classes are not related by subtyping then an instance of Foo should not be equal to an instance of Bar Among other issues doing so will likely result in an equals method that is not symmetrical For example if you define the Foo class so that a Foo can be equal to a String your equals method isn t symmetrical since a String can only be equal to a String In rare cases people do define nonsymmetrical equals methods and still manage to make their code work Although none of the APIs document or guarantee it it is typically the case that if you check if a Collection contains a Foo the equals method of argument e g the equals method of the Foo class used to perform the equality checks 44 HE Signature declares use of unhashable class in hashed construct HE SIGNATURE DECLARES HASHING OF UNHASHABLE CLASS A method field or class declares a generic signature where a non hashable class is used in context where a hashable class is required A class that declares an equals method but inherits a hashCode method from Object is unhashable since it doesn t fulfill the requirement that equal objects have equal hashCodes 45 HE Use of class without a hashCode method in a hashed data structure HE USE OF UNHASHABLE CLASS A class defines an equals Object method but not a hashCode method and thus doesn t fulfill the requirement that equal objects have equal hashCodes An instance of this class is used in a hash data structure making the need to fix this problem of highest importance 46 ICAST integral value cast to double and then passed to Math ceil ICAST INT CAST TO DOUBLE PASSED TO CEIL integral 的值转换为 double 后使用了 Math ceil 方法 47 ICAST int value cast to float and then passed to Math round ICAST INT CAST TO FLOAT PASSED TO ROUND int 类型的值转换为 float 类型之后调用了 Math round 方法 48 IJU JUnit assertion in run method will not be noticed by JUnit IJU ASSERT METHOD INVOKED FROM RUN METHOD 在 JUnit 中的断言在 run 方法中不会被告知 49 IJ