............................................................................................................................................
Lint4j v.0.9.1
Project Documentation
............................................................................................................................................
jutils.com 07 May 2006
Table of Contents
............................................................................................................................................
1
Lint4j Documentation
1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Eclipse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2.1 Eclipse Plugin User Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 Maven Plugin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.4 Using Lint4j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.5 Detected Problems and Defects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.5.1 Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.5.2 Java Language Constructs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.5.3 Java Core API Contracts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
1.5.4 Architectual problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
1.5.5 Immature Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
1.5.6 Code portability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
1.5.7 Serialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
1.5.8 Suspicious Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.5.9 Synchronization and Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1.5.10 Readability and Code Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
1.5.11 EJB Spec Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
1.6 Conducting Audits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
1.6.1 Auditing Sun Smart Ticket . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
1.7 Download . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
1.8 Mailing Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
1.9 About us . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
TABLE OF CONTENTS
i
©2003 JUTILS.COM • ALL RIGHTS RESERVED
TABLE OF CONTENTS
ii
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.1
Overview
............................................................................................................................................
News
! !!
"# #! # $ % & # '
Lint4j Summary
() *)+ * $ $, '! ! &
# $ # & ' # * , $ #!
$#& & ' !# $
# # $ !
! & # !! !
! - #! $ ! . . &
-/
' # # # #!
# ! # $& 01' * ( .231- 231
1& 1 *4"" +& 5 2 ## -##
.#& 2#"*1 & 2#231 .231- #& *1 *4"" ##
% & # ! ' 6
7 * 8& $ 9& '& :& 1 !& 5$ 4
7 " * 8!! ;& $ * 1& -<5$ 4
7 1! 8 *& $ " -& -8 44
7 * 4& 8 !& .! & 3 ;& 8</& 4
7 * !! =#& 4 & $ * ;!& 1 *$& ;$ =& ; 1
1.1 OVERVIEW
1
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.2
Eclipse
............................................................................................................................................
Lint4j Eclipse Plugin
"# # ! 8 # &
"# # ' $ $ ! !
* > 8'! $&
! #& *-1 ! ! $
#& ! #
#
#! ! '
Requirements
#! ? "# @ & ! $ *9:
Installation
8! ! "# 8! ! . # A3
#6BBB#<#
Screen Shots
.' ! #
1.2 ECLIPSE
2
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.2.1
Eclipse Plugin User Guide
............................................................................................................................................
1.2.1 ECLIPSE PLUGIN USER GUIDE
3
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.3
Maven Plugin
............................................................................................................................................
Lint4j Maven Plugin
8! # ! # !$
!
Requirements
#! ! ?6
7 *9: *3"
7
#! $ 4
Installation
#! ! ## dependencies $ project.xml
<dependency>
<groupId>lint4j</groupId>
<artifactId>jutils-lint4j-plugin</artifactId>
<version>1.2</version>
<type>plugin</type>
</dependency>
! ## reports reports $ project.xml
<report>jutils-lint4j-plugin</report>
- ! #C maven.properties 6
maven.repo.remote=http://www.ibiblio.org/maven,http://www.jutils.com/maven
% $ ! #$& 8# 8!
Plugin Properties
Property Name Description
maven.lint4j.level The warning level, default value is "3". Valid range is from 1-5.
Sample Report
/ # # *4"" # ;
1.3 MAVEN PLUGIN
4
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.4
Using Lint4j
............................................................................................................................................
Using the command line interface
SYNOPSIS
AD%6
lint4j [-J vmoptions] [-v level] -sourcepath path[:path]* [-classpath
path[:path]*] [-exclude packagename]* [-class class[:class]*] packagename+
5 ( +6
lint4j.bat [-J vmoptions] [-home lint4jpath] [-javahome path] [-v level]
-sourcepath path[;path]* [-classpath path[;path]*] [-exclude packagename]*
[-class class[:class]*] [packagename | filename]+
Description
#! # #'!& $, #
6
7 <* # < # # * 0& # <* E)< <4E)
! # , % #& !
7 < # < # $ 2#
(5 $+
7 < # < 2#& # (5
$+
7 < < #$ $ ! 3! (+ !! (>+ 9
@ 2#
7 <# # < #$ $ #
$,& ! BAB=B = # #& # $ C6C (CFC
5+& ! -sourcepath dir1:dir2
7 <# # < #$ # $ & ,#
& & = # #& # $ C6C (CFC 5+&
! -classpath lib/one.jar:lib/two.jar
! 2#
7 < #'! < ! #'! #'! # $& ! -exclude
java.lang ! #'!& -exclude java.lang. #'!
! ! 2#
7 < '& # $ C6C . $ ?
2#
% #'! $ #$ #'! G& '
#'! #'! /& ! $ #&
! #'! $ #$! G C '
Examples
/ ' ( ' $ # A
#! CGC+6
prompt> lint4j -sourcepath src/main -classpath lib/bcel.jar:lib/ant.jar
com.jutils.lint4j.\*
1.4 USING LINT4J
5
©2003 JUTILS.COM • ALL RIGHTS RESERVED
%'! ! $ ( ' $ # A
#! CGC+6
prompt> lint4j -sourcepath /Users/Shared/lib/log4j.jar org.apache.\*
%'! #'! ! $ 6
prompt> lint4j -sourcepath /Users/Shared/lib/log4j.jar org.apache.log4j
org.apache.log4j.spi
%'! 1." > 6
prompt> lint4j -sourcepath . org/apache/bcel/verifier/VerifierFactory.java
org/apache/bcel/verifier/Verifier.java
2 5 ' ' 6
prompt> lint4j -sourcepath src/main -classpath "lib/bcel.jar;lib/ant.jar"
com.jutils.lint4j.*
- # ' *9: & >
& *1 @4 & *1 & =AD *4"" #& # & - 1 & 8= &
= ' ##& # A # ' *9: & >&
*1 @4& *1
! 8= # # # !
Ant Integration
- '& ! 0 -
Installation
- #! $ #$! %D*H/2"BB -DH/2"B & $
! ' !
<taskdef name="lint4j" classname="com.jutils.lint4j.ant.Lint4jAntTask">
<classpath><pathelement location="${distdir}/jars/lint4j.jar"/></classpath>
</taskdef>
Lint4j Task Attributes
sourcepath specify the paths that contain the
source files for Lint4j to analyze.
Several paths can be specified,
separated by the ',' character.
Not set Yes, unless sourcepathRef is used
sourcepathRef specify the paths that contain the
source files for Lint4j to analyze in
terms of an Ant reference
Not set Yes, unless sourcepath is used
classpath specify the paths for all additional
classes referenced by the source
files. Several paths can be
specified, separated by the ','
character, e.g.
classpath="lib/one.jar,lib/two.jar".
Classes specified here will not be
analyzed.
Not set No
1.4 USING LINT4J
6
©2003 JUTILS.COM • ALL RIGHTS RESERVED
classpathRef specify the paths that contain the
source files for Lint4j to analyze in
terms of an Ant reference
Not set No
packages Analyze the classes in the
specified packages. The names
must be fully qualified, and
separated by a comma only (e.g.
no whitespace)
Not set No
classes Analyzes the given classes. The
names must be fully qualified, and
separated by a comma only (e.g.
no whitespace)
Not set No
sourcefiles Analyzes the specified source or
class files. The file names may be
relative or absolute.
Not set No
level the minimum severity level for
emitted warnings. Valid range is
from 1 (error) to 5 (notice).
3 No
ignorePackages the package names that should be
skipped in the analysis.
Not set No
exact Emit only warnings of the same
severity as specified by the level
argument
false No
#& # #<' &
I#J& I#J IJ & #$
' ## formatters #$
! #
formatters specify one or more formatters that
transform the generated reports
into text format
Generated text output to
System.out
No
- <formatters> IJ 6
toFile the file name the report is written to System.out No
type the output format. The types "text"
and "xml" are currently supported.
No Yes
Examples
/ ' ## # ' > % '
!# #'! sourcepath& ! $# !
classpath & # !!
)B#B>)
<target name="check-tomcat5" description="Perform checks on Tomcat 5">
<lint4j
ignorePackages="org.apache.tomcat.util.net.puretls,org.apache.coyote.tomcat3,org.apache.ajp.tomcat33"
packages="org.apache.*" level="${lint4j.level}" exact="${lint4j.exact}">
<sourcepath>
<dirset dir="${tomcat5.src.path}">
<include name="**/src/share" />
<include name="**/src/java" />
<exclude name="**/test/**" />
</dirset>
<pathelement path="${tomcat5.src.path}/jakarta-tomcat-connectors/util/java" />
<pathelement path="${tomcat5.src.path}/jakarta-tomcat-connectors/naming/src"
/>
<pathelement path="${tomcat5.src.path}/jakarta-tomcat-connectors/util/loader"
/>
</sourcepath>
<classpath>
<fileset dir="/var/tmp/tomcat5-deps/">
1.4 USING LINT4J
7
©2003 JUTILS.COM • ALL RIGHTS RESERVED
<include name="**/*.jar" />
</fileset>
</classpath>
<formatters>
<formatter type="text" />
<formatter type="text" toFile="/tmp/tomcat5.out"/>
<formatter type="xml" toFile="/tmp/tomcat5.xml"/>
</formatters>
</lint4j>
</target>
! = ' # # # !
- '
$ ! # % - ' $& ' - '
$ , A6
env ANT_OPTS="-Xmx300M" ant mygoal
Emacs JDEE Integration
D - <D !$ *9"" #! *9"" )* 9#
" ")& < #'! " # $
!& !& !!!& ! * ##
Standard Emacs Integration
"& < #& #& #6
lint4j -sourcepath src/mystuff -classpath lib/my.jar com.mystuff.\*
?$ ' $& make& AntAnt '
-emacs ! " ! '6 ant -emacs 2
#! ! $ ! ! "
# ! &
1.4 USING LINT4J
8
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.4 USING LINT4J
9
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5
Detected Problems and Defects
............................................................................................................................................
Build system and IDE Integration
! ' (* + $ $
% ! $ ' %9" $ .$ ##! &
- '& " !
Detected Problems and Enforced Contracts
7 - #
7 . * -8%
7 * !! .
7 %
7 8
7 . # $
7 =, ",
7 =# ! '$ !
7 * =$, = $
7 .! # # $ ,
7 0 "*1 #
1.5 DETECTED PROBLEMS AND DEFECTS
10
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.1
Performance
............................................................................................................................................
Performance problems
Unnecessary instanceof operator
D * # #, $ instanceof # $&
# $$
=6 3 instanceof
=$ 6 4
Using the += operator on java.lang.String
KL # !=! $# =!1 !
( #$ M+ & ! ##(+
! % #$ =!1 '& #$
# KL # =!
=6 C # #$ & =!1
=$ 6 @
Using StringBuffer.setLength()
(+ $ , M&
! , # # # #
% # ! $ , & '
! ! $
=6 =!1 ! =!1!(+
=$ 6 @
Repeated calls to java.lang.Thread.currentThread
(+ # & $ '
/=# # & #
=6 # < $& % # &
! # !
=$ 6 @
Using String.getBytes() or String.getBytes(String) with ASCII data
1 # ? # & -=.%%
=$ 6 @
Calling System.gc() or Runtime.gc()
= @
1.5.1 PERFORMANCE
11
©2003 JUTILS.COM • ALL RIGHTS RESERVED
=6
=$ 6 @
Using the default constructor of java.lang.StringBuffer
=!1 M $ % $
!$ ! , 1$ ! # ? $
#
=6 =!1(+ ,
=$ 6
StringBuffer fields
=!1 ! ? !& $ ' ! !
=6 #
=$ 6
Using the java.lang.String(java.lang.String) constructor
=! * #!! !! % $ =!
! =!& ! ! $
# #$ & $ !& ''#! ! ! !
=6
=$ 6
Using the java.lang.Boolean(boolean) constructor
-! @ 0& ! 13A" 1N-="
! ! 5 !< &
! !< " #& ' #
A!
=6 13A" 1N-="& 1( +
=$ 6
Unnecessary casts of a type to the same or a supertype
D * # #, $ $&
=6 3
=$ 6
Creation of zero-length arrays, instead of using a constant
= $ & C 5 !< &
! !< " #&
' # A!
=6 , ! $& ! $
=$ 6 >
1.5.1 PERFORMANCE
12
©2003 JUTILS.COM • ALL RIGHTS RESERVED
Assigning the default initialization values to fields
"$ ! , null $ "#$
!! $& ' !!! #& !
=6 C !
=$ 6 >
1.5.1 PERFORMANCE
13
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.2
Java Language Constructs
............................................................................................................................................
Java language related problems
A return in a finally block
- return $ ' ' F
& $ $ & !! #
=6
=$ 6
A throw in a finally block
- throw $ ' ' % ' #
$ '& ' ## #$ #
=6 # ! $ '
=$ 6
Empty catch blocks
"#$ ' ## ' # # ##
$
=6 3 # ' (! throw new IllegalStateException();&
assert false;
=$ 6 4
Catching Error or Throwable
" C ! $ !& $ = F $
# C $ & ! $
=6 3 # !&
=$ 6 4
Switch statements without default branch
= $ ! #
=6 #& !%!="#&
assert false;
=$ 6 @
Case statements that may fall through
. ! $ & ' & #
*= ! break
=6 & $
1.5.2 JAVA LANGUAGE CONSTRUCTS
14
©2003 JUTILS.COM • ALL RIGHTS RESERVED
=$ 6 @
Pathological Switch statements
- switch # if & $
# !&
=6 # $ if
=$ 6 @
1.5.2 JAVA LANGUAGE CONSTRUCTS
15
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.3
Java Core API Contracts
............................................................................................................................................
Contracts on java.lang.Object
Explicit calls to finalize()
,(+ $& ' $ * 0 $ = = -8%
=6 & ! , $ !
#
=$ 6
Overriding clone without implementing Cloneable
? #! # !.
& C
=6 ' # !.
=$ 6
Clone implementation uses Constructor
' & # !
super.clone() %
=6 A super.clone() & C #$
=$ 6
Usage of finalize()
2 $ ,(+ & 6
7 #! ! ! & $ $
7 !& $
7 ! ! '' # $ (!
#+
7 , ! (! 0 & #+
=6 ! , $ ! #
=$ 6 4
Empty finalize() method
5 ! ,& # ! ##$ # & $ !
super.finalize()
=6 !
=$ 6 4
1.5.3 JAVA CORE API CONTRACTS
16
©2003 JUTILS.COM • ALL RIGHTS RESERVED
Using equals() on Arrays
?(+ $ $# $ $& $
=6 A equals -$ ##
=$ 6 4
The methods hashCode and equals are not both overridden in a type
equals hashCode !$ #$
? hashCode % # C
C '$ /#
=6 #
=$ 6 @
1.5.3 JAVA CORE API CONTRACTS
17
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.4
Architectual problems
............................................................................................................................................
Architectual problems
Local variables that shadow accessible fields
- # & ! #!!
=6 ! !
=$ 6
Field declarations that shadow accessible fields in a super type
- # # & !
#!!
=6 & ###
=$ 6
Class implementing an interface already implemented by a superclass
)#) $ # $ #
? $ ! # & $ !
#
=6 )#) ' ? $
$ ! .6 , A%9 !
A%9
=$ 6 4
Interface declaring a method already declared by an extended interface
- $ $
=6
=$ 6 @
Abstract class without abstract method
C $ & '$ # $ $
#
=6 # & #
=$ 6 @
Abstract methods overrides abstract method
- #
=6
=$ 6 @
1.5.4 ARCHITECTUAL PROBLEMS
18
©2003 JUTILS.COM • ALL RIGHTS RESERVED
Empty method implementation in abstract class
- #$ # % $
& # ###
=6 . !
=$ 6 @
Abstract class without abstract method
C $ & '$ # $ $
#
=6 # & #
=$ 6 @
Abstract class without any method
C $ & # $ ' =
$ #
=6
=$ 6 @
A class using any of its subclasses
- $# ! $# ' #
#
=6 $ # #$#
=$ 6 @
Poor exception propagation
8 # ##! $ ! ! ## # ! &
!"#& !"& !3"#
=6 # # # * & $
=$ 6
1.5.4 ARCHITECTUAL PROBLEMS
19
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.5
Immature Code
............................................................................................................................................
Code Maturity problems
' ! ! # ! #
$#$ & $ !
Call to java.lang.Throwable.printStackTrace or java.lang.Thread.dumpStack
! # !!!
=6 #
=$ 6
Using System.err or System.out
A! =$ =$ # ! #
!!!
=6 #
=$ 6
Using Vector or Hashtable
# $ . % & 0 /
$,& $ $ #
=6 # 0 -$& / /#&
=$ 6 @
Empty blocks in try/finally/if/for/while/do/synchronized constructs
"#$ ' try& finally& if& for& while& while& synchronized
(! # + ! # #
=6 C $
=$ 6 @
1.5.5 IMMATURE CODE
20
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.6
Code portability
............................................................................................................................................
Code Portability problems
Call to System.exit or Runtime.halt
A! #$ $!
#! $ = & ' #
$ '
=6 & # & $ ! assert ! #
=$ 6 4
Operating System specific methods
System.getenv() Runtime.exec() # #! $
! N #& #! $ Runtime.exec() $
#& $ #$ # =$&
$ System.getenv() $ $ & $ #! $
# (! #+& $ $
=6 $ $ $
=$ 6
Hardcoded newline characters
? #! $ # \r \n !
!
System.getProperty("line.separator") # $ #! $
=6 System.getProperty("line.separator")
=$ 6 >
1.5.6 CODE PORTABILITY
21
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.7
Serialization
............................................................................................................................................
Serialization and Externalization problems
The first non-serializable super-class doesn't have an accessible zero-argument constructor
<, #< C ,<! & ? $
* =, #
=6 ,<! ,
=$ 6
An Externalizable class doesn't have a public zero-argument constructor
- ", C # ,<! & ? $
* =, #
=6 # ,<!
=$ 6
Serializable class containig a non-transient field of a non-serializable type
=, ! < <, $# ' ,
$# & $#
=$ 6
Wrong definition of serialVersionUID
* =, # ! serialVersionUID
M 6 private static final long serialVersionUID = 3487495895819393L;
=6
=$ 6
Wrong definition of serialPersistentFields
* =, # ! serialPersistentFields
> 6 private static final ObjectStreamField[] serialPersistentFields =
{new ObjectStreamField("next", List.class)};
=6
=$ 6
Non-static inner classes that implement Serializable w/o a serialVersionUID field
* =, # !$ M
# =, serialVersionUID
=6
=$ 6
1.5.7 SERIALIZATION
22
©2003 JUTILS.COM • ALL RIGHTS RESERVED
Non-static inner classes where the enclosing class is not serializable
=, & ! &
, 8 * =, #
#
=6
=$ 6
Using serialVersionUID or serialPersistentFields in a class that is not serializable
A! serialVersionUID serialPersistentFields , !
& '$ #!! #
",
=6 ' # =,
=$ 6
Using serialization-related methods in a class that is not serializable
A! readObject& readResolve& writeObject& writeReplace ,
! & '$ #!!
=6 ' # =,
=$ 6
Using serialization methods in a class that is externalizable
A! readObject writeObject ", & $ '
=6
=$ 6
Wrong method signatures for custom serialization
! ,< # * =,
# ! 4@<> <M * =,
#
=6
=$ 6
Fields defined in serialPersistentFields that don't exist
! !
=6 $ serialPersistentFields
=$ 6
Detect inherited readExternal() and writeExternal() methods when the subclass has additional
serializable fields
" ", # "(+
"(+ ## ,
=6 # "(+ "(+
1.5.7 SERIALIZATION
23
©2003 JUTILS.COM • ALL RIGHTS RESERVED
=$ 6
1.5.7 SERIALIZATION
24
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.8
Suspicious Code
............................................................................................................................................
Suspicious code or possible bugs
Assignment has no effect
- x=x $ #! & '$ ##
#
=6 # this.x=x& ###
=$ 6
Accidental Assignment
- ! #& ! if(haveSource=true)
# $ ?$ ' 6 if(haveSource==true)
=6 ! ! #& ###
=$ 6
Method with constructor name
- & $
=6 ! $ ! $#& ###
=$ 6
Using equals() or == on Arrays
1 ?(+ LL # ' $ $ % &
' $
=6 -$?(+ # $
=$ 6
Comparing strings with the == operator
=!& ' $ & # ! ?(+ % &
#!! $ F LL # =!&
*= 2$ =! # # # $
LL #& =! # < ? ! (+
% * *9: @ & =!?(+ ?$
! # $< ?$& # # LL
# & ' !
=6 ?(+ # =!
=$ 6 4
Comparing objects with the == operator
#$ & !.&
1.5.8 SUSPICIOUS CODE
25
©2003 JUTILS.COM • ALL RIGHTS RESERVED
#!! # #! $ * -8%&
!! # null this& $ ?(+ &
#
=6 # ! ?(+ % ! # #
# ! LL # $ ! ?$ ?
& ! # $ $ $< #
=$ 6
Equality comparisons with floating point types
N! # $# $ # A! # LL OL ! $ #
& #$ ! #
=6 !
=$ 6 4
Immutable field could be static
N # # $
#
=6
=$ 6 4
1.5.8 SUSPICIOUS CODE
26
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.9
Synchronization and Scalability
............................................................................................................................................
Thread-related problems
Arithmetic operations on volatile types
- # $# & # #!!
% # $ ! $# =
PP *= # $ & C % & !
! & '
# #
=6 $,
=$ 6
Usage of volatile long and double types
-! * !! =# ! !
= PP & $ * 0 ! =AD 0 ! # %
$ & $ 0
=6 A $,& !
=$ 6
Excessively deep lock nesting
! ' & ) ) % &
'
=6 $ $ $ '
=$ 6
Possible deadlocks because of wrong lock ordering
2 $ ? ' # ? '
##
$, !# ! ! #
=6
=$ 6
Calls to Object.wait(), notify(), notifyAll() w/o lock
5 ! (+& $(+& $-(+ & ! '
& # 3 -8%
=6 # synchronized
=$ 6
Calls to Object.wait() with more than one lock held
1.5.9 SYNCHRONIZATION AND SCALABILITY
27
©2003 JUTILS.COM • ALL RIGHTS RESERVED
5 ! (+ ! # % ' !
& ' '! #! & '
3 -8%
=6 $ ' ! (+
=$ 6
Calls to native methods while holding locks
D # & #$ =C 0& C ! '#
$, '
=6 $, '& #
=$ 6 4
Inconsistent use of locks when accessing fields
N? ' ' <' '! & !
C $, .# Q * !! =#
! * !
=6 $,
=$ 6 @
Using Hashtable in a static field
/ $ /! # $ #
$ < / & $
8#
=6 /#
=$ 6 4
Objects used for locking that are not declared final
9! ' final !
# & # #
=6
=$ 6
1.5.9 SYNCHRONIZATION AND SCALABILITY
28
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.10
Readability and Code Size
............................................................................................................................................
Readability and Code Size
Unnecesary return statement
&
=6
=$ 6
Negated if statement
- if # #< #
!$ $ ! ! !
=6 #
=$ 6
1.5.10 READABILITY AND CODE SIZE
29
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.5.11
EJB Spec Violations
............................................................................................................................................
Verifying EJB 2.1 compliance
' # $ "*1 #$ "*1 4 #& $
/
Static fields
= 4>4 & "*1 $ #$
=$ 6 4
Thread synchronization
= 4>4 $,& "*1 $ #$
=$ 6
Native code
= 4>4 "*1
=$ 6
Field is not serializable
- "# 1 =, & <
, &
=$ 6
EJB use prohibited class
= 4>4 # ! 6
7 N
7 N%#=
7 N2#=
7 N3
7 N5
7 ='
7 =='
7 3-N
7 !.
7 !
7 !;#
=$ 6
1.5.11 EJB SPEC VIOLATIONS
30
©2003 JUTILS.COM • ALL RIGHTS RESERVED
EJB uses forbidden method call
= 4>4 # 6
7 -5 =! # #
7 # #
7 N2#=
7 N3
7 N5
7 ='
7 =='
7 3-N
7 !.
7 !
7 !;#
=$ 6
Missing default constructor
= P4& M4& 444& >P4 # '
!
=$ 6
Initialization in constructor
%, # setEntityContext setSessionContext
=$ 6
Wrong class modifiers for session
= P4 ? public& final
abstract
=$ 6
EJB implements finalize()
= P4& M4& 444& >P4 "*1 # ,(+
=$ 6
Session Bean ejbCreate signature
= P4 ejbCreate void& final static
=$ 6
Use of RemoteException
= P4& M4& 444 "*1"# 3"#
=$ 6
1.5.11 EJB SPEC VIOLATIONS
31
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.6
Conducting Audits
............................................................................................................................................
Auditing code with Lint4j
# ' # # ! $ <' <
# $ #$
Document Description
Setting up Lint4j for command line usage This document describes how to set up Lint4j for a new project if you
want to use the command line interface.
Auditing Sun Blueprint Smart Ticket This document contains an audit of the Sun Blueprint Smart Ticket
application, using the Lint4j Ant integration.
1.6 CONDUCTING AUDITS
32
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.6.1
Auditing Sun Smart Ticket
............................................................................................................................................
Auditing Sun's Smart Ticket Blueprint Application
#
Creating the Ant file
# # .! $ #& '
#'! & )) (' 4+
/Users/Shared/smart_ticket2.0]% find . -type d -name src
./src
./src/app/client/midp/src
./src/app/server/ejb/src
./src/app/server/web/src
./src/app/shared/src
= ' # !6
/Users/Shared/smart_ticket2.0]% find . -name \*.zip -o -name \*.jar
./smart_ticket-client.jar
./src/tools/ant/lib/ant.jar
./src/tools/ant/lib/crimson.jar
./src/tools/ant/lib/jaxp.jar
1 # ! - ' 6
<lint4j packages="com.sun.j2me.*">
<sourcepath>
<dirset dir="${ticket.src.path}">
<include name="**/src" />
</dirset>
</sourcepath>
<classpath>
<fileset dir="${adventure.src.path}">
<include name="**/*.jar" />
</fileset>
</classpath>
</lint4j>
- # ! $ #& #
! 6
<classpath>
<fileset dir="${adventure.src.path}">
<include name="**/*.jar" />
</fileset>
<pathelement path="${servlet.jar.path}" />
<pathelement path="${ejb.jar.path}" />
<pathelement path="${jms.jar.path}" />
<pathelement path="${mail.jar.path}" />
</classpath>
1.6.1 AUDITING SUN SMART TICKET
33
©2003 JUTILS.COM • ALL RIGHTS RESERVED
D $ #
Most severe warnings
N& C ' # # = ' 4
ant -Dlint4j.level=1 -emacs check-ticket
Buildfile: build.xml
check-ticket:
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/MovieRating.java:151:
(1): Statement has no effect, possible scoping problem
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/TheaterSchedule.java:118:
(1): The local variable "showTimes" shadows an accessible field with the same name and
compatible type in class
com.sun.j2me.blueprints.smartticket.shared.midp.model.TheaterSchedule.MovieSchedule
src/app/server/ejb/src/com/sun/j2me/blueprints/smartticket/server/ejb/SmartTicketFacadeBean.java:234:
(1): The local variable "account" shadows an accessible field with the same name and
compatible type in class
com.sun.j2me.blueprints.smartticket.server.ejb.SmartTicketFacadeBean
src/app/server/ejb/src/com/sun/j2me/blueprints/smartticket/server/ejb/SmartTicketFacadeBean.java:451:
(1): The local variable "account" shadows an accessible field with the same name and
compatible type in class
com.sun.j2me.blueprints.smartticket.server.ejb.SmartTicketFacadeBean
src/app/server/ejb/src/com/sun/j2me/blueprints/smartticket/server/ejb/rating/MovieRatingData.java:128:
(1): Statement has no effect, possible scoping problem
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/AccountPopulator.java:174:
(1): The local variable "account" shadows an accessible field with the same name and
compatible type in class
com.sun.j2me.blueprints.smartticket.server.web.admin.populate.AccountPopulator
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/MoviePopulator.java:153:
(1): The local variable "movie" shadows an accessible field with the same name and
compatible type in class
com.sun.j2me.blueprints.smartticket.server.web.admin.populate.MoviePopulator
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/TheaterPopulator.java:163:
(1): The local variable "theater" shadows an accessible field with the same name and
compatible type in class
com.sun.j2me.blueprints.smartticket.server.web.admin.populate.TheaterPopulator
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/TheaterSchedulePopulator.java:115:
(1): The local variable "theaterSchedule" shadows an accessible field with the same name
and compatible type in class
com.sun.j2me.blueprints.smartticket.server.web.admin.populate.TheaterSchedulePopulator
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/LocalModel.java:68:
(1): Statement has no effect, possible scoping problem
'! #! # #& #
6
public void setLastViewingDate(long
viewingDate) {
this.lastViewingDate =
lastViewingDate;
[...]
}
public void setLastViewingDate(long
viewingDate) {
this.lastViewingDate = viewingDate;
[...]
}
protected static ProgressObserver
progressObserver;
public static void
setProgressObserver(ProgressObserver
progressObserver) {
progressObserver = progressObserver;
}
protected static ProgressObserver
progressObserver;
public static void
setProgressObserver(ProgressObserver
progressObserver) {
this.progressObserver =
progressObserver;
}
1.6.1 AUDITING SUN SMART TICKET
34
©2003 JUTILS.COM • ALL RIGHTS RESERVED
public void setLastViewingDate(long
viewingDate) {
this.lastViewingDate =
lastViewingDate;
[...]
}
public void setLastViewingDate(long
viewingDate) {
this.lastViewingDate = viewingDate;
[...]
}
#!! $ #!
D # ## &
! & ! $ ##& #$ # ##
- # ' #
private AccountLocal account = null;
[..]
if (account == null ||!account.getUserName().equals(userName)
||!account.getPassword().equals(password)) {
try {
AccountLocal account = (AccountLocal) accountHome.findByPrimaryKey(userName);
if (account.getPassword().equals(password)) {
this.account = account;
Potentially severe issues
D ! @& # ## 4
ant -Dlint4j.level=3 -Dlint4j.exact=true -emacs check-ticket
Buildfile: build.xml
check-ticket:
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/Movie.java:51:
(3): The method "equals" is overriden, but not the method "hashCode"
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/MovieRating.java:52:
(3): The method "equals" is overriden, but not the method "hashCode"
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/RecommendationRecipient.java:52:
(3): The method "equals" is overriden, but not the method "hashCode"
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/Theater.java:51:
(3): The method "equals" is overriden, but not the method "hashCode"
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/midp/SmartTicketBD.java:99:
(3): This catch block silently ignores the exception "javax.ejb.RemoveException".
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/midp/SmartTicketServlet.java:88:
(3): This finally statement is empty and should be removed because it prevents the JIT
from optimizing the code block.
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/midp/SmartTicketSessionListener.java:64:
(3): This catch block silently ignores the exception
"com.sun.j2me.blueprints.smartticket.shared.midp.ApplicationException".
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/PopulateServlet.java:178:
(3): This catch block silently ignores the exception
"com.sun.j2me.blueprints.smartticket.server.web.admin.populate.PopulateException".
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/PopulateServlet.java:228:
(3): The serialization specification strongly discourages non-static serializable inner
classes such as
"com.sun.j2me.blueprints.smartticket.server.web.admin.populate.PopulateServlet.ParsingDoneException"
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/XMLDBHandler.java:89:
(3): The method StringBuffer.setLength() should be avoided in favor of creating a new
StringBuffer.
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/XMLDBHandler.java:167:
(3): The method StringBuffer.setLength() should be avoided in favor of creating a new
StringBuffer.
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/XMLDBHandler.java:189:
(3): The method StringBuffer.setLength() should be avoided in favor of creating a new
StringBuffer.
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/XMLDBHandler.java:278:
(3): This catch block silently ignores the exception "java.lang.NumberFormatException".
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/LocalModel.java:308:
1.6.1 AUDITING SUN SMART TICKET
35
©2003 JUTILS.COM • ALL RIGHTS RESERVED
(3): This catch block silently ignores the exception
"com.sun.j2me.blueprints.smartticket.shared.midp.ApplicationException".
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/MessageHandler.java:53:
(3): This class is declared abstract but does not have an abstract method.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/RemoteModelRequestHandler.java:53:
(3): This class is declared abstract but does not have an abstract method.
! . #
##& '$ #
#$ finally ' ='= ! ## ##
finally {
// FIXME
}
! # ='=
} catch (ApplicationException ae) {
// XXX
}
$ sessionDestroyed #$
Noteworthy issues
D !
ant -Dlint4j.level=4 -Dlint4j.exact=true -emacs check-ticket
Buildfile: build.xml
check-ticket:
[..]
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/IndexedResourceBundle.java:161:
(4): The type "java.util.Vector" should be avoided and replaced with its counterpart
from the Collections classes if possible.
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/IndexedResourceBundle.java:171:
(4): Dont hardcode newline characters, use System.getProperty("line.separator") instead.
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/IndexedResourceBundle.java:171:
(4): Dont hardcode newline characters, use System.getProperty("line.separator") instead.
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/IndexedResourceBundle.java:250:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/IndexedResourceBundle.java:252:
(4): Dont hardcode newline characters, use System.getProperty("line.separator") instead.
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/IndexedResourceBundle.java:258:
(4): Don't hardcode newline characters, use System.getProperty("line.separator")
instead.
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/Movie.java:111:
(4): Object types such as "com.sun.j2me.blueprints.smartticket.shared.midp.model.Movie"
should be compared using the equals() method!
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/MovieRating.java:255:
(4): Object types such as
"com.sun.j2me.blueprints.smartticket.shared.midp.model.MovieRating" should be compared
using the equals() method!
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/RecommendationRecipient.java:100:
(4): Object types such as
"com.sun.j2me.blueprints.smartticket.shared.midp.model.RecommendationRecipient" should
be compared using the equals() method!
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/SeatingPlan.java:140:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/SeatingPlan.java:146:
(4): Don't hardcode newline characters, use System.getProperty("line.separator")
instead.
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/SyncAnchor.java:108:
1.6.1 AUDITING SUN SMART TICKET
36
©2003 JUTILS.COM • ALL RIGHTS RESERVED
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/shared/src/com/sun/j2me/blueprints/smartticket/shared/midp/model/Theater.java:106:
(4): Object types such as
"com.sun.j2me.blueprints.smartticket.shared.midp.model.Theater" should be compared using
the equals() method!
src/app/server/ejb/src/com/sun/j2me/blueprints/smartticket/server/ejb/SmartTicketFacadeBean.java:234:
(4): The cast to type
"com.sun.j2me.blueprints.smartticket.server.ejb.account.AccountLocal" is unnecessary,
since the operand already is of the same type.
src/app/server/ejb/src/com/sun/j2me/blueprints/smartticket/server/ejb/SmartTicketFacadeBean.java:451:
(4): The cast to type
"com.sun.j2me.blueprints.smartticket.server.ejb.account.AccountLocal" is unnecessary,
since the operand already is of the same type.
src/app/server/ejb/src/com/sun/j2me/blueprints/smartticket/server/ejb/show/Seating.java:174:
(4): The cast to type "byte" is unnecessary, since the operand already is of the same
type.
src/app/server/ejb/src/com/sun/j2me/blueprints/smartticket/server/ejb/show/Seating.java:179:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/server/ejb/src/com/sun/j2me/blueprints/smartticket/server/ejb/reservation/ReservationBean.java:120:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/MovieSchedulePopulator.java:86:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/MovieSchedulePopulator.java:97:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/XMLDBHandler.java:59:
(4): Make sure to null out the reference to type java.lang.StringBuffer as soon as
possible to avoid holding on to too much memory or system resources
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/XMLDBHandler.java:59:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/server/web/src/com/sun/j2me/blueprints/smartticket/server/web/admin/populate/XMLDBHandler.java:174:
(4): This "if" statement is easier to understand if the negetion is eliminated, and the
two branches are switched
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/util/ApplicationUtilities.java:45:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/util/ApplicationUtilities.java:179:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/LocalModel.java:96:
(4): The type "java.util.Vector" should be avoided and replaced with its counterpart
from the Collections classes if possible.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/ModelFacade.java:357:
(4): This "if" statement is easier to understand if the negetion is eliminated, and the
two branches are switched
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/ModelFacade.java:417:
(4): It is strongly recommended to create a StringBuffer with a reasonable initial size
instead of the default size of 16.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/Preferences.java:72:
(4): The type "java.util.Hashtable" should be avoided and replaced with its counterpart
from the Collections classes if possible.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/RemoteModelProxy.java:64:
(4): The type "java.util.Hashtable" should be avoided and replaced with its counterpart
from the Collections classes if possible.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/SynchronizationAgent.java:83:
(4): The type "java.util.Vector" should be avoided and replaced with its counterpart
from the Collections classes if possible.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/SynchronizationAgent.java:102:
(4): The type "java.util.Hashtable" should be avoided and replaced with its counterpart
from the Collections classes if possible.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/SynchronizationAgent.java:141:
(4): The type "java.util.Hashtable" should be avoided and replaced with its counterpart
from the Collections classes if possible.
src/app/client/midp/src/com/sun/j2me/blueprints/smartticket/client/midp/model/SynchronizationAgent.java:181:
(4): The type "java.util.Hashtable" should be avoided and replaced with its counterpart
from the Collections classes if possible.
- ! $ !!&
, % & 4 ! (=$# #='+
1.6.1 AUDITING SUN SMART TICKET
37
©2003 JUTILS.COM • ALL RIGHTS RESERVED
! ! !
Q 0 / & $, & #
$, -$ /#
?' = ' ##
1.6.1 AUDITING SUN SMART TICKET
38
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.7
Download
............................................................................................................................................
System Requirements
# *& $ # *9: *3"
# $ 2= 4 @& 3 / Q ! = *9:
& 4& %1 * & *3' Q 5 ## 5 8
License
!
Download
8 ! #
<!,
<,#
89N
Installation
A#' !, 6
cd yourfavoritedirectory
gnutar zxf lint4j-0.9.1.tar.gz
A#' ,# 5 5R# % $ #!
- '& $ !<' )$ .#) & ' )-) &
)" 0 ) 9 <' )8) $ )=$ ) % ! &
## $ # lint4j-0.9.1/bin $ )0 )
N #6
%\SystemRoot%\system32;%SystemRoot%;%\SystemRoot%\WBem;D:\lint4j-0.9.1\bin
$ 6
7 ./-D;"2; 6
7 %."D=" 6 !
7 < $ # lint4j 8 !
'
7 # < $ - # ' *9: &
> & *1 @4 & *1 & =AD *4"" #& # & -
1 & 8= & = ' ##& # A # ' *9:
& >& *1 @4& *1
7 < $ ##
1.7 DOWNLOAD
39
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.8
Mailing Lists
............................................................................................................................................
Lint4j Mailing Lists
! )H) # F
$ !& $
Subscribe Unsubscribe
Send an email to [email protected] with "subscribe
[email protected]" as the body
Send an email to [email protected] with "unsubscribe
[email protected]" as the body
1.8 MAILING LISTS
40
©2003 JUTILS.COM • ALL RIGHTS RESERVED
1.9
About us
............................................................................................................................................
Contact us
N ! #& & # ## #
' $ ! O
1.9 ABOUT US
41
©2003 JUTILS.COM • ALL RIGHTS RESERVED
