Static Analysis of Source Code

1. Jackpot (of NetBeans): Given the rule

$1.isDirectory() :: $1 instanceof java.io.File
=> !$1.isFile()
;;

it will rewrite

java.io.File testFile = new java.io.File("/tmp");
if (testFile.isDirectory()) {
    System.err.println("/tmp is a directory");
}

into

java.io.File testFile = new java.io.File("/tmp");
if (!testFile.isFile()) {
    System.err.println("/tmp is a directory");
}

1. http://autorefactor.org/ Site looks old-fashined, but content is good. Collection of Examples.

1. OWASP 35+ slides based on "Secure Programming with Static Analysis" 2008 book. https://www.owasp.org/index.php/Static_Code_Analysis. Lecture.
2. Secure Programming: Code Review and Static Analysis, 40+ slides, David Aspinall, University of Edinburgh, Scotland, 2016. Lecture.

1. Bad practice
2. Correctness
3. Dodgy
4. Experimental
5. Internationalization
6. Malicious code vulnerability
7. Multithreaded correctness
8. Performance
9. Security

1. Android Rules: These rules deal with the Android SDK.
2. Basic Rules: The Basic Ruleset contains a collection of good practices which everyone should follow.
3. Braces Rules: The Braces Ruleset contains a collection of braces rules.
4. Clone Implementation Rules: The Clone Implementation ruleset contains a collection of rules that find questionable usages of the clone() method.
5. Code Size Rules: The Code Size Ruleset contains a collection of rules that find code size related problems.
6. Controversial Rules: The Controversial Ruleset contains rules that, for whatever reason, are considered controversial.
7. Coupling Rules: These are rules which find instances of high or inappropriate coupling between objects and packages.
8. Design Rules: The Design Ruleset contains a collection of rules that find questionable designs.
9. Import Statement Rules: These rules deal with different problems that can occur with a class' import statements.
10. JavaBean Rules: The JavaBeans Ruleset catches instances of bean rules not being followed.
11. JUnit Rules: These rules deal with different problems that can occur with JUnit tests.
12. Java Logging Rules: The Java Logging ruleset contains a collection of rules that find questionable usages of the logger.
13. Migration Rules: Contains rules about migrating from one JDK version to another.
14. Migration15: Contains rules for migrating to JDK 1.5
15. Naming Rules: The Naming Ruleset contains a collection of rules about names - too long, too short, and so forth.
16. Optimization Rules: These rules deal with different optimizations that generally apply to performance best practices.
17. Strict Exception Rules: These rules provide some strict guidelines about throwing and catching exceptions.
18. String and StringBuffer Rules: Problems that can occur with manipulation of the class String or StringBuffer.
19. Security Code Guidelines: These rules check the security guidelines from Sun.
20. Unused Code Rules: The Unused Code Ruleset contains a collection of rules that find unused code.

1. EmptyCatchBlock: Empty Catch Block finds instances where an exception is caught, but not hing is done. In most circumstances, this swallows an exception which should either be acte d on or reported.
2. EmptyIfStmt: Empty If Statement finds instances where a condition is checked but nothing is done about it.
3. EmptyWhileStmt: Empty While Statement finds all instances where a while statement does nothing. If it is a timing loop, then you should use Thread.sleep() for it; if it's a while loop th at does a lot in the exit expression, rewrite it to make it clearer.
4. EmptyTryBlock: Avoid empty try blocks - what's the point?
5. EmptyFinallyBlock: Avoid empty finally blocks - these can be deleted.
6. EmptySwitchStatements: Avoid empty switch statements.
7. JumbledIncrementer: Avoid jumbled loop incrementers - it's usually a mistake, and it's conf using even if it's what's intended.
8. ForLoopShouldBeWhileLoop: Some for loops can be simplified to while loops - this makes t hem more concise.

1. ./findbugs-etc.pptx FindBugs, PMD, etc. Eclipse and IDEA Plugins. These are pmateti's slides. 2013.