给 spotbugs 提的 issues 备份

[Xiaoven]

Should issue warning for SecureRandom object created and used only once

I found a false negative when spotbugs-maven-plugin checked the following line in eclipse/jetty.project.

BigInteger serial = BigInteger.valueOf(new SecureRandom().nextLong());

According to the description of DMI: Random object created and used only once (DMI_RANDOM_USED_ONLY_ONCE):

You should strongly consider using a java.security.SecureRandom instead (and avoid allocating a new SecureRandom for each random number needed).

Spotbugs should generate a warning because the line use the line created and used SecureRandom object only once.

The plugin version used is as follow:

            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>4.1.4</version>
                <configuration>
                    <effort>Default</effort>
                    <threshold>Low</threshold>
                </configuration>
                <dependencies>
                    <dependency>
                        <groupId>com.github.spotbugs</groupId>
                        <artifactId>spotbugs</artifactId>
                        <version>4.1.4</version>
                    </dependency>
                </dependencies>
            </plugin>

Demo

Here is a small demo that could be used as test case.

import java.security.SecureRandom;
import java.util.Random;
import edu.umd.cs.findbugs.annotations.ExpectWarning;

public class DMI_RANDOM_USED_ONLY_ONCE {
    @ExpectWarning("DMI_RANDOM_USED_ONLY_ONCE")
    long m1(){
        return new SecureRandom().nextLong();  // This test case will fail now
    }

    @ExpectWarning("DMI_RANDOM_USED_ONLY_ONCE")
    long m2(){
        return new Random().nextLong();  // This will pass
    }
}

[Xiaoven]

False Negative for IM_MULTIPLYING_RESULT_OF_IREM on the official example (Flagged)

In the official bug description of IM: Integer multiply of result of integer remainder (IM_MULTIPLYING_RESULT_OF_IREM), you say

The code multiplies the result of an integer remaining by an integer constant. Be sure you don't have your operator precedence confused. For example i % 60 * 1000 is (i % 60) * 1000, not i % (60 * 1000).

I tried the official example i % 60 * 1000 with spotbugs IDEA plugin, but got no warning.

[Xiaoven]

Inappropriate warnings in the context of write or log methods