fix pmd
This commit is contained in:
parent
270acc90a1
commit
251ba3762d
13 changed files with 10813 additions and 11 deletions
17
build.gradle
17
build.gradle
|
|
@ -148,19 +148,16 @@ subprojects {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
tasks.withType(Pmd) {
|
pmd {
|
||||||
|
toolVersion = '6.11.0'
|
||||||
|
ruleSets = ['category/java/bestpractices.xml']
|
||||||
ignoreFailures = true
|
ignoreFailures = true
|
||||||
reports {
|
|
||||||
xml.enabled = true
|
|
||||||
html.enabled = true
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
tasks.withType(Checkstyle) {
|
checkstyle {
|
||||||
|
configFile = rootProject.file('config/checkstyle/checkstyle.xml')
|
||||||
ignoreFailures = true
|
ignoreFailures = true
|
||||||
reports {
|
showViolations = true
|
||||||
xml.enabled = true
|
|
||||||
html.enabled = true
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
sonarqube {
|
sonarqube {
|
||||||
|
|
|
||||||
323
config/checkstyle/checkstyle.xml
Normal file
323
config/checkstyle/checkstyle.xml
Normal file
|
|
@ -0,0 +1,323 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE module PUBLIC
|
||||||
|
"-//Puppy Crawl//DTD Check Configuration 1.3//EN"
|
||||||
|
"http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
|
||||||
|
|
||||||
|
<!-- This is a checkstyle configuration file. For descriptions of
|
||||||
|
what the following rules do, please see the checkstyle configuration
|
||||||
|
page at http://checkstyle.sourceforge.net/config.html -->
|
||||||
|
|
||||||
|
<module name="Checker">
|
||||||
|
|
||||||
|
<module name="FileTabCharacter">
|
||||||
|
<!-- Checks that there are no tab characters in the file.
|
||||||
|
-->
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="NewlineAtEndOfFile">
|
||||||
|
<property name="lineSeparator" value="lf"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="RegexpSingleline">
|
||||||
|
<!-- Checks that FIXME is not used in comments. TODO is preferred.
|
||||||
|
-->
|
||||||
|
<property name="format" value="((//.*)|(\*.*))FIXME" />
|
||||||
|
<property name="message" value='TODO is preferred to FIXME. e.g. "TODO(johndoe): Refactor when v2 is released."' />
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="RegexpSingleline">
|
||||||
|
<!-- Checks that TODOs are named. (Actually, just that they are followed
|
||||||
|
by an open paren.)
|
||||||
|
-->
|
||||||
|
<property name="format" value="((//.*)|(\*.*))TODO[^(]" />
|
||||||
|
<property name="message" value='All TODOs should be named. e.g. "TODO(johndoe): Refactor when v2 is released."' />
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="JavadocPackage">
|
||||||
|
<!-- Checks that each Java package has a Javadoc file used for commenting.
|
||||||
|
Only allows a package-info.java, not package.html. -->
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<!-- All Java AST specific tests live under TreeWalker module. -->
|
||||||
|
<module name="TreeWalker">
|
||||||
|
|
||||||
|
<!--
|
||||||
|
|
||||||
|
IMPORT CHECKS
|
||||||
|
|
||||||
|
-->
|
||||||
|
|
||||||
|
<module name="RedundantImport">
|
||||||
|
<!-- Checks for redundant import statements. -->
|
||||||
|
<property name="severity" value="error"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="ImportOrder">
|
||||||
|
<!-- Checks for out of order import statements. -->
|
||||||
|
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
<property name="groups" value="com,junit,net,org,java,javax"/>
|
||||||
|
<!-- This ensures that static imports go first. -->
|
||||||
|
<property name="option" value="top"/>
|
||||||
|
<property name="tokens" value="STATIC_IMPORT, IMPORT"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
|
||||||
|
JAVADOC CHECKS
|
||||||
|
|
||||||
|
-->
|
||||||
|
|
||||||
|
<!-- Checks for Javadoc comments. -->
|
||||||
|
<!-- See http://checkstyle.sf.net/config_javadoc.html -->
|
||||||
|
<module name="JavadocMethod">
|
||||||
|
<property name="scope" value="protected"/>
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
<property name="allowMissingJavadoc" value="true"/>
|
||||||
|
<property name="allowMissingParamTags" value="true"/>
|
||||||
|
<property name="allowMissingReturnTag" value="true"/>
|
||||||
|
<property name="allowMissingThrowsTags" value="true"/>
|
||||||
|
<property name="allowThrowsTagsForSubclasses" value="true"/>
|
||||||
|
<property name="allowUndeclaredRTE" value="true"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="JavadocType">
|
||||||
|
<property name="scope" value="protected"/>
|
||||||
|
<property name="severity" value="error"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="JavadocStyle">
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
|
||||||
|
NAMING CHECKS
|
||||||
|
|
||||||
|
-->
|
||||||
|
|
||||||
|
<!-- Item 38 - Adhere to generally accepted naming conventions -->
|
||||||
|
|
||||||
|
<module name="PackageName">
|
||||||
|
<!-- Validates identifiers for package names against the
|
||||||
|
supplied expression. -->
|
||||||
|
<!-- Here the default checkstyle rule restricts package name parts to
|
||||||
|
seven characters, this is not in line with common practice at Google.
|
||||||
|
-->
|
||||||
|
<property name="format" value="^[a-z]+(\.[a-z][a-z0-9]{1,})*$"/>
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="TypeNameCheck">
|
||||||
|
<!-- Validates static, final fields against the
|
||||||
|
expression "^[A-Z][a-zA-Z0-9]*$". -->
|
||||||
|
<metadata name="altname" value="TypeName"/>
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="ConstantNameCheck">
|
||||||
|
<!-- Validates non-private, static, final fields against the supplied
|
||||||
|
public/package final fields "^[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$". -->
|
||||||
|
<metadata name="altname" value="ConstantName"/>
|
||||||
|
<property name="applyToPublic" value="true"/>
|
||||||
|
<property name="applyToProtected" value="true"/>
|
||||||
|
<property name="applyToPackage" value="true"/>
|
||||||
|
<property name="applyToPrivate" value="false"/>
|
||||||
|
<property name="format" value="^([A-Z][A-Z0-9]*(_[A-Z0-9]+)*|FLAG_.*)$"/>
|
||||||
|
<message key="name.invalidPattern"
|
||||||
|
value="Variable ''{0}'' should be in ALL_CAPS (if it is a constant) or be private (otherwise)."/>
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="StaticVariableNameCheck">
|
||||||
|
<!-- Validates static, non-final fields against the supplied
|
||||||
|
expression "^[a-z][a-zA-Z0-9]*_?$". -->
|
||||||
|
<metadata name="altname" value="StaticVariableName"/>
|
||||||
|
<property name="applyToPublic" value="true"/>
|
||||||
|
<property name="applyToProtected" value="true"/>
|
||||||
|
<property name="applyToPackage" value="true"/>
|
||||||
|
<property name="applyToPrivate" value="true"/>
|
||||||
|
<property name="format" value="^[a-z][a-zA-Z0-9]*_?$"/>
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="MemberNameCheck">
|
||||||
|
<!-- Validates non-static members against the supplied expression. -->
|
||||||
|
<metadata name="altname" value="MemberName"/>
|
||||||
|
<property name="applyToPublic" value="true"/>
|
||||||
|
<property name="applyToProtected" value="true"/>
|
||||||
|
<property name="applyToPackage" value="true"/>
|
||||||
|
<property name="applyToPrivate" value="true"/>
|
||||||
|
<property name="format" value="^[a-z][a-zA-Z0-9]*$"/>
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="MethodNameCheck">
|
||||||
|
<!-- Validates identifiers for method names. -->
|
||||||
|
<metadata name="altname" value="MethodName"/>
|
||||||
|
<property name="format" value="^[a-z][a-zA-Z0-9]*(_[a-zA-Z0-9]+)*$"/>
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="ParameterName">
|
||||||
|
<!-- Validates identifiers for method parameters against the
|
||||||
|
expression "^[a-z][a-zA-Z0-9]*$". -->
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="LocalFinalVariableName">
|
||||||
|
<!-- Validates identifiers for local final variables against the
|
||||||
|
expression "^[a-z][a-zA-Z0-9]*$". -->
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="LocalVariableName">
|
||||||
|
<!-- Validates identifiers for local variables against the
|
||||||
|
expression "^[a-z][a-zA-Z0-9]*$". -->
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
|
||||||
|
<!--
|
||||||
|
|
||||||
|
LENGTH and CODING CHECKS
|
||||||
|
|
||||||
|
-->
|
||||||
|
|
||||||
|
<module name="LineLength">
|
||||||
|
<!-- Checks if a line is too long. -->
|
||||||
|
<property name="max" value="${com.puppycrawl.tools.checkstyle.checks.sizes.LineLength.max}" default="128"/>
|
||||||
|
<property name="severity" value="error"/>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
The default ignore pattern exempts the following elements:
|
||||||
|
- import statements
|
||||||
|
- long URLs inside comments
|
||||||
|
-->
|
||||||
|
|
||||||
|
<property name="ignorePattern"
|
||||||
|
value="${com.puppycrawl.tools.checkstyle.checks.sizes.LineLength.ignorePattern}"
|
||||||
|
default="^(package .*;\s*)|(import .*;\s*)|( *(\*|//).*https?://.*)$"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="LeftCurly">
|
||||||
|
<!-- Checks for placement of the left curly brace ('{'). -->
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="RightCurly">
|
||||||
|
<!-- Checks right curlies on CATCH, ELSE, and TRY blocks are on
|
||||||
|
the same line. e.g., the following example is fine:
|
||||||
|
<pre>
|
||||||
|
if {
|
||||||
|
...
|
||||||
|
} else
|
||||||
|
</pre>
|
||||||
|
-->
|
||||||
|
<!-- This next example is not fine:
|
||||||
|
<pre>
|
||||||
|
if {
|
||||||
|
...
|
||||||
|
}
|
||||||
|
else
|
||||||
|
</pre>
|
||||||
|
-->
|
||||||
|
<property name="option" value="same"/>
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<!-- Checks for braces around if and else blocks -->
|
||||||
|
<module name="NeedBraces">
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
<property name="tokens" value="LITERAL_IF, LITERAL_ELSE, LITERAL_FOR, LITERAL_WHILE, LITERAL_DO"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="UpperEll">
|
||||||
|
<!-- Checks that long constants are defined with an upper ell.-->
|
||||||
|
<property name="severity" value="error"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="FallThrough">
|
||||||
|
<!-- Warn about falling through to the next case statement. Similar to
|
||||||
|
javac -Xlint:fallthrough, but the check is suppressed if a single-line comment
|
||||||
|
on the last non-blank line preceding the fallen-into case contains 'fall through' (or
|
||||||
|
some other variants which we don't publicized to promote consistency).
|
||||||
|
-->
|
||||||
|
<property name="reliefPattern"
|
||||||
|
value="fall through|Fall through|fallthru|Fallthru|falls through|Falls through|fallthrough|Fallthrough|No break|NO break|no break|continue on"/>
|
||||||
|
<property name="severity" value="error"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
|
||||||
|
<!--
|
||||||
|
|
||||||
|
MODIFIERS CHECKS
|
||||||
|
|
||||||
|
-->
|
||||||
|
|
||||||
|
<module name="ModifierOrder">
|
||||||
|
<!-- Warn if modifier order is inconsistent with JLS3 8.1.1, 8.3.1, and
|
||||||
|
8.4.3. The prescribed order is:
|
||||||
|
public, protected, private, abstract, static, final, transient, volatile,
|
||||||
|
synchronized, native, strictfp
|
||||||
|
-->
|
||||||
|
</module>
|
||||||
|
|
||||||
|
|
||||||
|
<!--
|
||||||
|
|
||||||
|
WHITESPACE CHECKS
|
||||||
|
|
||||||
|
-->
|
||||||
|
|
||||||
|
<module name="WhitespaceAround">
|
||||||
|
<!-- Checks that various tokens are surrounded by whitespace.
|
||||||
|
This includes most binary operators and keywords followed
|
||||||
|
by regular or curly braces.
|
||||||
|
-->
|
||||||
|
<property name="tokens" value="ASSIGN, BAND, BAND_ASSIGN, BOR,
|
||||||
|
BOR_ASSIGN, BSR, BSR_ASSIGN, BXOR, BXOR_ASSIGN, COLON, DIV, DIV_ASSIGN,
|
||||||
|
EQUAL, GE, GT, LAND, LE, LITERAL_CATCH, LITERAL_DO, LITERAL_ELSE,
|
||||||
|
LITERAL_FINALLY, LITERAL_FOR, LITERAL_IF, LITERAL_RETURN,
|
||||||
|
LITERAL_SYNCHRONIZED, LITERAL_TRY, LITERAL_WHILE, LOR, LT, MINUS,
|
||||||
|
MINUS_ASSIGN, MOD, MOD_ASSIGN, NOT_EQUAL, PLUS, PLUS_ASSIGN, QUESTION,
|
||||||
|
SL, SL_ASSIGN, SR_ASSIGN, STAR, STAR_ASSIGN"/>
|
||||||
|
<property name="severity" value="error"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="WhitespaceAfter">
|
||||||
|
<!-- Checks that commas, semicolons and typecasts are followed by
|
||||||
|
whitespace.
|
||||||
|
-->
|
||||||
|
<property name="tokens" value="COMMA, SEMI, TYPECAST"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="NoWhitespaceAfter">
|
||||||
|
<!-- Checks that there is no whitespace after various unary operators.
|
||||||
|
Linebreaks are allowed.
|
||||||
|
-->
|
||||||
|
<property name="tokens" value="BNOT, DEC, DOT, INC, LNOT, UNARY_MINUS,
|
||||||
|
UNARY_PLUS"/>
|
||||||
|
<property name="allowLineBreaks" value="true"/>
|
||||||
|
<property name="severity" value="error"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="NoWhitespaceBefore">
|
||||||
|
<!-- Checks that there is no whitespace before various unary operators.
|
||||||
|
Linebreaks are allowed.
|
||||||
|
-->
|
||||||
|
<property name="tokens" value="SEMI, DOT, POST_DEC, POST_INC"/>
|
||||||
|
<property name="allowLineBreaks" value="true"/>
|
||||||
|
<property name="severity" value="error"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
<module name="ParenPad">
|
||||||
|
<!-- Checks that there is no whitespace before close parens or after
|
||||||
|
open parens.
|
||||||
|
-->
|
||||||
|
<property name="severity" value="warning"/>
|
||||||
|
</module>
|
||||||
|
|
||||||
|
</module>
|
||||||
|
</module>
|
||||||
|
|
||||||
7
config/checkstyle/suppressions.xml
Normal file
7
config/checkstyle/suppressions.xml
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
<!DOCTYPE suppressions PUBLIC
|
||||||
|
"-//Puppy Crawl//DTD Suppressions 1.1//EN"
|
||||||
|
"http://www.puppycrawl.com/dtds/suppressions_1_1.dtd">
|
||||||
|
<suppressions>
|
||||||
|
<suppress checks="." files="[\\/]generated-src[\\/].*\.java$"/>
|
||||||
|
</suppressions>
|
||||||
1636
config/pmd/category/java/bestpractices.xml
Normal file
1636
config/pmd/category/java/bestpractices.xml
Normal file
File diff suppressed because it is too large
Load diff
13
config/pmd/category/java/categories.properties
Normal file
13
config/pmd/category/java/categories.properties
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
#
|
||||||
|
# BSD-style license; for more info see http://pmd.sourceforge.net/license.html
|
||||||
|
#
|
||||||
|
|
||||||
|
rulesets.filenames=\
|
||||||
|
category/java/bestpractices.xml,\
|
||||||
|
category/java/codestyle.xml,\
|
||||||
|
category/java/design.xml,\
|
||||||
|
category/java/documentation.xml,\
|
||||||
|
category/java/errorprone.xml,\
|
||||||
|
category/java/multithreading.xml,\
|
||||||
|
category/java/performance.xml,\
|
||||||
|
category/java/security.xml
|
||||||
2176
config/pmd/category/java/codestyle.xml
Normal file
2176
config/pmd/category/java/codestyle.xml
Normal file
File diff suppressed because it is too large
Load diff
1657
config/pmd/category/java/design.xml
Normal file
1657
config/pmd/category/java/design.xml
Normal file
File diff suppressed because it is too large
Load diff
144
config/pmd/category/java/documentation.xml
Normal file
144
config/pmd/category/java/documentation.xml
Normal file
|
|
@ -0,0 +1,144 @@
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
|
||||||
|
<ruleset name="Documentation"
|
||||||
|
xmlns="http://pmd.sourceforge.net/ruleset/2.0.0"
|
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||||
|
xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.sourceforge.io/ruleset_2_0_0.xsd">
|
||||||
|
|
||||||
|
<description>
|
||||||
|
Rules that are related to code documentation.
|
||||||
|
</description>
|
||||||
|
|
||||||
|
<rule name="CommentContent"
|
||||||
|
since="5.0"
|
||||||
|
message="Invalid words or phrases found"
|
||||||
|
class="net.sourceforge.pmd.lang.java.rule.documentation.CommentContentRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_documentation.html#commentcontent">
|
||||||
|
<description>
|
||||||
|
A rule for the politically correct... we don't want to offend anyone.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
//OMG, this is horrible, Bob is an idiot !!!
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="CommentRequired"
|
||||||
|
since="5.1"
|
||||||
|
message="Comment is required"
|
||||||
|
class="net.sourceforge.pmd.lang.java.rule.documentation.CommentRequiredRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_documentation.html#commentrequired">
|
||||||
|
<description>
|
||||||
|
Denotes whether comments are required (or unwanted) for specific language elements.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
/**
|
||||||
|
*
|
||||||
|
*
|
||||||
|
* @author Jon Doe
|
||||||
|
*/
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="CommentSize"
|
||||||
|
since="5.0"
|
||||||
|
message="Comment is too large"
|
||||||
|
class="net.sourceforge.pmd.lang.java.rule.documentation.CommentSizeRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_documentation.html#commentsize">
|
||||||
|
<description>
|
||||||
|
Determines whether the dimensions of non-header comments found are within the specified limits.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
/**
|
||||||
|
*
|
||||||
|
* too many lines!
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="UncommentedEmptyConstructor"
|
||||||
|
language="java"
|
||||||
|
since="3.4"
|
||||||
|
message="Document empty constructor"
|
||||||
|
class="net.sourceforge.pmd.lang.rule.XPathRule"
|
||||||
|
typeResolution="true"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_documentation.html#uncommentedemptyconstructor">
|
||||||
|
<description>
|
||||||
|
Uncommented Empty Constructor finds instances where a constructor does not
|
||||||
|
contain statements, but there is no comment. By explicitly commenting empty
|
||||||
|
constructors it is easier to distinguish between intentional (commented)
|
||||||
|
and unintentional empty constructors.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<properties>
|
||||||
|
<property name="xpath">
|
||||||
|
<value>
|
||||||
|
<![CDATA[
|
||||||
|
//ConstructorDeclaration[@Private='false']
|
||||||
|
[count(BlockStatement) = 0 and ($ignoreExplicitConstructorInvocation = 'true' or not(ExplicitConstructorInvocation)) and @containsComment = 'false']
|
||||||
|
[not(../Annotation/MarkerAnnotation/Name[pmd-java:typeIs('javax.inject.Inject')])]
|
||||||
|
]]>
|
||||||
|
</value>
|
||||||
|
</property>
|
||||||
|
<property name="ignoreExplicitConstructorInvocation" type="Boolean" description="Ignore explicit constructor invocation when deciding whether constructor is empty or not" value="false"/>
|
||||||
|
</properties>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public Foo() {
|
||||||
|
// This constructor is intentionally empty. Nothing special is needed here.
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="UncommentedEmptyMethodBody"
|
||||||
|
language="java"
|
||||||
|
since="3.4"
|
||||||
|
message="Document empty method body"
|
||||||
|
class="net.sourceforge.pmd.lang.rule.XPathRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_documentation.html#uncommentedemptymethodbody">
|
||||||
|
<description>
|
||||||
|
Uncommented Empty Method Body finds instances where a method body does not contain
|
||||||
|
statements, but there is no comment. By explicitly commenting empty method bodies
|
||||||
|
it is easier to distinguish between intentional (commented) and unintentional
|
||||||
|
empty methods.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<properties>
|
||||||
|
<property name="xpath">
|
||||||
|
<value>
|
||||||
|
<![CDATA[
|
||||||
|
//MethodDeclaration/Block[count(BlockStatement) = 0 and @containsComment = 'false']
|
||||||
|
]]>
|
||||||
|
</value>
|
||||||
|
</property>
|
||||||
|
</properties>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public void doSomething() {
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
</ruleset>
|
||||||
3383
config/pmd/category/java/errorprone.xml
Normal file
3383
config/pmd/category/java/errorprone.xml
Normal file
File diff suppressed because it is too large
Load diff
393
config/pmd/category/java/multithreading.xml
Normal file
393
config/pmd/category/java/multithreading.xml
Normal file
|
|
@ -0,0 +1,393 @@
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
|
||||||
|
<ruleset name="Multithreading"
|
||||||
|
xmlns="http://pmd.sourceforge.net/ruleset/2.0.0"
|
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||||
|
xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.sourceforge.io/ruleset_2_0_0.xsd">
|
||||||
|
|
||||||
|
<description>
|
||||||
|
Rules that flag issues when dealing with multiple threads of execution.
|
||||||
|
</description>
|
||||||
|
|
||||||
|
<rule name="AvoidSynchronizedAtMethodLevel"
|
||||||
|
language="java"
|
||||||
|
since="3.0"
|
||||||
|
message="Use block level rather than method level synchronization"
|
||||||
|
class="net.sourceforge.pmd.lang.rule.XPathRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#avoidsynchronizedatmethodlevel">
|
||||||
|
<description>
|
||||||
|
Method-level synchronization can cause problems when new code is added to the method.
|
||||||
|
Block-level synchronization helps to ensure that only the code that needs synchronization
|
||||||
|
gets it.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<properties>
|
||||||
|
<property name="xpath">
|
||||||
|
<value>//MethodDeclaration[@Synchronized='true']</value>
|
||||||
|
</property>
|
||||||
|
</properties>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public class Foo {
|
||||||
|
// Try to avoid this:
|
||||||
|
synchronized void foo() {
|
||||||
|
}
|
||||||
|
// Prefer this:
|
||||||
|
void bar() {
|
||||||
|
synchronized(this) {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Try to avoid this for static methods:
|
||||||
|
static synchronized void fooStatic() {
|
||||||
|
}
|
||||||
|
|
||||||
|
// Prefer this:
|
||||||
|
static void barStatic() {
|
||||||
|
synchronized(Foo.class) {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="AvoidThreadGroup"
|
||||||
|
language="java"
|
||||||
|
since="3.6"
|
||||||
|
message="Avoid using java.lang.ThreadGroup; it is not thread safe"
|
||||||
|
class="net.sourceforge.pmd.lang.rule.XPathRule"
|
||||||
|
typeResolution="true"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#avoidthreadgroup">
|
||||||
|
<description>
|
||||||
|
Avoid using java.lang.ThreadGroup; although it is intended to be used in a threaded environment
|
||||||
|
it contains methods that are not thread-safe.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<properties>
|
||||||
|
<property name="xpath">
|
||||||
|
<value>
|
||||||
|
<![CDATA[
|
||||||
|
//AllocationExpression/ClassOrInterfaceType[pmd-java:typeIs('java.lang.ThreadGroup')]|
|
||||||
|
//PrimarySuffix[contains(@Image, 'getThreadGroup')]
|
||||||
|
]]>
|
||||||
|
</value>
|
||||||
|
</property>
|
||||||
|
</properties>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public class Bar {
|
||||||
|
void buz() {
|
||||||
|
ThreadGroup tg = new ThreadGroup("My threadgroup");
|
||||||
|
tg = new ThreadGroup(tg, "my thread group");
|
||||||
|
tg = Thread.currentThread().getThreadGroup();
|
||||||
|
tg = System.getSecurityManager().getThreadGroup();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="AvoidUsingVolatile"
|
||||||
|
language="java"
|
||||||
|
since="4.1"
|
||||||
|
class="net.sourceforge.pmd.lang.rule.XPathRule"
|
||||||
|
message="Use of modifier volatile is not recommended."
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#avoidusingvolatile">
|
||||||
|
<description>
|
||||||
|
Use of the keyword 'volatile' is generally used to fine tune a Java application, and therefore, requires
|
||||||
|
a good expertise of the Java Memory Model. Moreover, its range of action is somewhat misknown. Therefore,
|
||||||
|
the volatile keyword should not be used for maintenance purpose and portability.
|
||||||
|
</description>
|
||||||
|
<priority>2</priority>
|
||||||
|
<properties>
|
||||||
|
<property name="xpath">
|
||||||
|
<value>//FieldDeclaration[contains(@Volatile,'true')]</value>
|
||||||
|
</property>
|
||||||
|
</properties>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public class ThrDeux {
|
||||||
|
private volatile String var1; // not suggested
|
||||||
|
private String var2; // preferred
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="DoNotUseThreads"
|
||||||
|
language="java"
|
||||||
|
since="4.1"
|
||||||
|
class="net.sourceforge.pmd.lang.rule.XPathRule"
|
||||||
|
message="To be compliant to J2EE, a webapp should not use any thread."
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#donotusethreads">
|
||||||
|
<description>
|
||||||
|
The J2EE specification explicitly forbids the use of threads.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<properties>
|
||||||
|
<property name="xpath">
|
||||||
|
<value>//ClassOrInterfaceType[@Image = 'Thread' or @Image = 'Runnable']</value>
|
||||||
|
</property>
|
||||||
|
</properties>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
// This is not allowed
|
||||||
|
public class UsingThread extends Thread {
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
// Neither this,
|
||||||
|
public class OtherThread implements Runnable {
|
||||||
|
// Nor this ...
|
||||||
|
public void methode() {
|
||||||
|
Runnable thread = new Thread(); thread.run();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="DontCallThreadRun"
|
||||||
|
language="java"
|
||||||
|
since="4.3"
|
||||||
|
message="Don't call Thread.run() explicitly, use Thread.start()"
|
||||||
|
class="net.sourceforge.pmd.lang.rule.XPathRule"
|
||||||
|
typeResolution="true"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#dontcallthreadrun">
|
||||||
|
<description>
|
||||||
|
Explicitly calling Thread.run() method will execute in the caller's thread of control. Instead, call Thread.start() for the intended behavior.
|
||||||
|
</description>
|
||||||
|
<priority>4</priority>
|
||||||
|
<properties>
|
||||||
|
<property name="xpath">
|
||||||
|
<value>
|
||||||
|
<![CDATA[
|
||||||
|
//StatementExpression/PrimaryExpression
|
||||||
|
[
|
||||||
|
PrimaryPrefix
|
||||||
|
[
|
||||||
|
./Name[ends-with(@Image, '.run') or @Image = 'run']
|
||||||
|
and substring-before(Name/@Image, '.') =//VariableDeclarator/VariableDeclaratorId/@Image
|
||||||
|
[../../../Type/ReferenceType/ClassOrInterfaceType[pmd-java:typeIs('java.lang.Thread')]]
|
||||||
|
or (./AllocationExpression/ClassOrInterfaceType[pmd-java:typeIs('java.lang.Thread')]
|
||||||
|
and ../PrimarySuffix[@Image = 'run'])
|
||||||
|
]
|
||||||
|
]
|
||||||
|
]]>
|
||||||
|
</value>
|
||||||
|
</property>
|
||||||
|
</properties>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
Thread t = new Thread();
|
||||||
|
t.run(); // use t.start() instead
|
||||||
|
new Thread().run(); // same violation
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="DoubleCheckedLocking"
|
||||||
|
language="java"
|
||||||
|
since="1.04"
|
||||||
|
message="Double checked locking is not thread safe in Java."
|
||||||
|
class="net.sourceforge.pmd.lang.java.rule.multithreading.DoubleCheckedLockingRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#doublecheckedlocking">
|
||||||
|
<description>
|
||||||
|
Partially created objects can be returned by the Double Checked Locking pattern when used in Java.
|
||||||
|
An optimizing JRE may assign a reference to the baz variable before it calls the constructor of the object the
|
||||||
|
reference points to.
|
||||||
|
|
||||||
|
Note: With Java 5, you can make Double checked locking work, if you declare the variable to be `volatile`.
|
||||||
|
|
||||||
|
For more details refer to: <http://www.javaworld.com/javaworld/jw-02-2001/jw-0209-double.html>
|
||||||
|
or <http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html>
|
||||||
|
</description>
|
||||||
|
<priority>1</priority>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public class Foo {
|
||||||
|
/*volatile */ Object baz = null; // fix for Java5 and later: volatile
|
||||||
|
Object bar() {
|
||||||
|
if (baz == null) { // baz may be non-null yet not fully created
|
||||||
|
synchronized(this) {
|
||||||
|
if (baz == null) {
|
||||||
|
baz = new Object();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return baz;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="NonThreadSafeSingleton"
|
||||||
|
since="3.4"
|
||||||
|
message="Singleton is not thread safe"
|
||||||
|
class="net.sourceforge.pmd.lang.java.rule.multithreading.NonThreadSafeSingletonRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#nonthreadsafesingleton">
|
||||||
|
<description>
|
||||||
|
Non-thread safe singletons can result in bad state changes. Eliminate
|
||||||
|
static singletons if possible by instantiating the object directly. Static
|
||||||
|
singletons are usually not needed as only a single instance exists anyway.
|
||||||
|
Other possible fixes are to synchronize the entire method or to use an
|
||||||
|
[initialize-on-demand holder class](https://en.wikipedia.org/wiki/Initialization-on-demand_holder_idiom).
|
||||||
|
|
||||||
|
Refrain from using the double-checked locking pattern. The Java Memory Model doesn't
|
||||||
|
guarantee it to work unless the variable is declared as `volatile`, adding an uneeded
|
||||||
|
performance penalty. [Reference](http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html)
|
||||||
|
|
||||||
|
See Effective Java, item 48.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
private static Foo foo = null;
|
||||||
|
|
||||||
|
//multiple simultaneous callers may see partially initialized objects
|
||||||
|
public static Foo getFoo() {
|
||||||
|
if (foo==null) {
|
||||||
|
foo = new Foo();
|
||||||
|
}
|
||||||
|
return foo;
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="UnsynchronizedStaticDateFormatter"
|
||||||
|
since="3.6"
|
||||||
|
deprecated="true"
|
||||||
|
message="Static DateFormatter objects should be accessed in a synchronized manner"
|
||||||
|
class="net.sourceforge.pmd.lang.java.rule.multithreading.UnsynchronizedStaticDateFormatterRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#unsynchronizedstaticdateformatter">
|
||||||
|
<description>
|
||||||
|
SimpleDateFormat instances are not synchronized. Sun recommends using separate format instances
|
||||||
|
for each thread. If multiple threads must access a static formatter, the formatter must be
|
||||||
|
synchronized either on method or block level.
|
||||||
|
|
||||||
|
This rule has been deprecated in favor of the rule {% rule UnsynchronizedStaticFormatter %}.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public class Foo {
|
||||||
|
private static final SimpleDateFormat sdf = new SimpleDateFormat();
|
||||||
|
void bar() {
|
||||||
|
sdf.format(); // poor, no thread-safety
|
||||||
|
}
|
||||||
|
synchronized void foo() {
|
||||||
|
sdf.format(); // preferred
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="UnsynchronizedStaticFormatter"
|
||||||
|
since="6.11.0"
|
||||||
|
message="Static Formatter objects should be accessed in a synchronized manner"
|
||||||
|
class="net.sourceforge.pmd.lang.java.rule.multithreading.UnsynchronizedStaticFormatterRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#unsynchronizedstaticformatter">
|
||||||
|
<description>
|
||||||
|
Instances of `java.text.Format` are generally not synchronized.
|
||||||
|
Sun recommends using separate format instances for each thread.
|
||||||
|
If multiple threads must access a static formatter, the formatter must be
|
||||||
|
synchronized either on method or block level.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public class Foo {
|
||||||
|
private static final SimpleDateFormat sdf = new SimpleDateFormat();
|
||||||
|
void bar() {
|
||||||
|
sdf.format(); // poor, no thread-safety
|
||||||
|
}
|
||||||
|
synchronized void foo() {
|
||||||
|
sdf.format(); // preferred
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="UseConcurrentHashMap"
|
||||||
|
language="java"
|
||||||
|
minimumLanguageVersion="1.5"
|
||||||
|
since="4.2.6"
|
||||||
|
message="If you run in Java5 or newer and have concurrent access, you should use the ConcurrentHashMap implementation"
|
||||||
|
class="net.sourceforge.pmd.lang.rule.XPathRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#useconcurrenthashmap">
|
||||||
|
<description>
|
||||||
|
Since Java5 brought a new implementation of the Map designed for multi-threaded access, you can
|
||||||
|
perform efficient map reads without blocking other threads.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<properties>
|
||||||
|
<property name="xpath">
|
||||||
|
<value>
|
||||||
|
<![CDATA[
|
||||||
|
//Type[../VariableDeclarator/VariableInitializer//AllocationExpression/ClassOrInterfaceType[@Image != 'ConcurrentHashMap']]
|
||||||
|
/ReferenceType/ClassOrInterfaceType[@Image = 'Map']
|
||||||
|
]]>
|
||||||
|
</value>
|
||||||
|
</property>
|
||||||
|
</properties>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public class ConcurrentApp {
|
||||||
|
public void getMyInstance() {
|
||||||
|
Map map1 = new HashMap(); // fine for single-threaded access
|
||||||
|
Map map2 = new ConcurrentHashMap(); // preferred for use with multiple threads
|
||||||
|
|
||||||
|
// the following case will be ignored by this rule
|
||||||
|
Map map3 = someModule.methodThatReturnMap(); // might be OK, if the returned map is already thread-safe
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="UseNotifyAllInsteadOfNotify"
|
||||||
|
language="java"
|
||||||
|
since="3.0"
|
||||||
|
message="Call Thread.notifyAll() rather than Thread.notify()"
|
||||||
|
class="net.sourceforge.pmd.lang.rule.XPathRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_multithreading.html#usenotifyallinsteadofnotify">
|
||||||
|
<description>
|
||||||
|
Thread.notify() awakens a thread monitoring the object. If more than one thread is monitoring, then only
|
||||||
|
one is chosen. The thread chosen is arbitrary; thus its usually safer to call notifyAll() instead.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<properties>
|
||||||
|
<property name="xpath">
|
||||||
|
<value>
|
||||||
|
<![CDATA[
|
||||||
|
//StatementExpression/PrimaryExpression
|
||||||
|
[PrimarySuffix/Arguments[@ArgumentCount = '0']]
|
||||||
|
[
|
||||||
|
PrimaryPrefix[
|
||||||
|
./Name[@Image='notify' or ends-with(@Image,'.notify')]
|
||||||
|
or ../PrimarySuffix/@Image='notify'
|
||||||
|
or (./AllocationExpression and ../PrimarySuffix[@Image='notify'])
|
||||||
|
]
|
||||||
|
]
|
||||||
|
]]>
|
||||||
|
</value>
|
||||||
|
</property>
|
||||||
|
</properties>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
void bar() {
|
||||||
|
x.notify();
|
||||||
|
// If many threads are monitoring x, only one (and you won't know which) will be notified.
|
||||||
|
// use instead:
|
||||||
|
x.notifyAll();
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
</ruleset>
|
||||||
1006
config/pmd/category/java/performance.xml
Normal file
1006
config/pmd/category/java/performance.xml
Normal file
File diff suppressed because it is too large
Load diff
65
config/pmd/category/java/security.xml
Normal file
65
config/pmd/category/java/security.xml
Normal file
|
|
@ -0,0 +1,65 @@
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
|
||||||
|
<ruleset name="Security" xmlns="http://pmd.sourceforge.net/ruleset/2.0.0"
|
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||||
|
xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.sourceforge.io/ruleset_2_0_0.xsd">
|
||||||
|
|
||||||
|
<description>
|
||||||
|
Rules that flag potential security flaws.
|
||||||
|
</description>
|
||||||
|
|
||||||
|
<rule name="HardCodedCryptoKey"
|
||||||
|
since="6.4.0"
|
||||||
|
message="Do not use hard coded encryption keys"
|
||||||
|
class="net.sourceforge.pmd.lang.java.rule.security.HardCodedCryptoKeyRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_security.html#hardcodedcryptokey">
|
||||||
|
<description>
|
||||||
|
Do not use hard coded values for cryptographic operations. Please store keys outside of source code.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public class Foo {
|
||||||
|
void good() {
|
||||||
|
SecretKeySpec secretKeySpec = new SecretKeySpec(Properties.getKey(), "AES");
|
||||||
|
}
|
||||||
|
|
||||||
|
void bad() {
|
||||||
|
SecretKeySpec secretKeySpec = new SecretKeySpec("my secret here".getBytes(), "AES");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
<rule name="InsecureCryptoIv"
|
||||||
|
since="6.3.0"
|
||||||
|
message="Do not use hard coded initialization vector in crypto operations"
|
||||||
|
class="net.sourceforge.pmd.lang.java.rule.security.InsecureCryptoIvRule"
|
||||||
|
externalInfoUrl="${pmd.website.baseurl}/pmd_rules_java_security.html#insecurecryptoiv">
|
||||||
|
<description>
|
||||||
|
Do not use hard coded initialization vector in cryptographic operations. Please use a randomly generated IV.
|
||||||
|
</description>
|
||||||
|
<priority>3</priority>
|
||||||
|
<example>
|
||||||
|
<![CDATA[
|
||||||
|
public class Foo {
|
||||||
|
void good() {
|
||||||
|
SecureRandom random = new SecureRandom();
|
||||||
|
byte iv[] = new byte[16];
|
||||||
|
random.nextBytes(bytes);
|
||||||
|
}
|
||||||
|
|
||||||
|
void bad() {
|
||||||
|
byte[] iv = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, };
|
||||||
|
}
|
||||||
|
|
||||||
|
void alsoBad() {
|
||||||
|
byte[] iv = "secret iv in here".getBytes();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]]>
|
||||||
|
</example>
|
||||||
|
</rule>
|
||||||
|
|
||||||
|
</ruleset>
|
||||||
|
|
@ -167,11 +167,13 @@ public class ListRecordsFilterReader extends XMLFilterReader {
|
||||||
ZonedDateTime zonedDateTime = localDate.atStartOfDay(ZoneId.of("UTC"));
|
ZonedDateTime zonedDateTime = localDate.atStartOfDay(ZoneId.of("UTC"));
|
||||||
header.setDate(Instant.from(zonedDateTime));
|
header.setDate(Instant.from(zonedDateTime));
|
||||||
} catch (DateTimeParseException e2) {
|
} catch (DateTimeParseException e2) {
|
||||||
|
if (logger.isLoggable(Level.WARNING)) {
|
||||||
logger.log(Level.WARNING, "unable to parse date: " + s + " reason = " + e2.getMessage());
|
logger.log(Level.WARNING, "unable to parse date: " + s + " reason = " + e2.getMessage());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
break;
|
break;
|
||||||
case "setSpec":
|
case "setSpec":
|
||||||
if (header != null && content != null && content.length() > 0) {
|
if (header != null && content != null && content.length() > 0) {
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue