Upgrade SpotBugs to 4.8.4 (#1001)

* deps: Upgraded SpotBugs to 4.8.4, updated profiles and rules count
spotbugs · Apr 15, 2024 · b3b75d8 · b3b75d8
1 parent e9aff8f
commit b3b75d8
Show file tree

Hide file tree

Showing 9 changed files with 146 additions and 9 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -126,7 +126,7 @@ jobs:
  uses: ./.github/actions/sonar-update-center
  with:
  prop-file: findbugs.properties
- description: Use SpotBugs 4.8.3, sb-contrib 7.6.4, and findsecbugs 1.13.0
+ description: Use SpotBugs 4.8.4, sb-contrib 7.6.4, and findsecbugs 1.13.0
  minimal-supported-sq-version: 9.9
  latest-supported-sq-version: LATEST
  changelog-url: https://github.com/spotbugs/sonar-findbugs/releases/tag/${{ github.event.release.tag_name }}

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # SonarQube Spotbugs Plugin
 [![.github/workflows/build.yml](https://github.com/spotbugs/sonar-findbugs/actions/workflows/build.yml/badge.svg)](https://github.com/spotbugs/sonar-findbugs/actions/workflows/build.yml)
-![FindBugs Rules](https://img.shields.io/badge/SpotBugs_rules-933-brightgreen.svg?maxAge=2592000)
+![FindBugs Rules](https://img.shields.io/badge/SpotBugs_rules-940-brightgreen.svg?maxAge=2592000)
 [![Coverage Status](https://sonarcloud.io/api/project_badges/measure?project=com.github.spotbugs%3Asonar-findbugs-plugin&metric=coverage)](https://sonarcloud.io/component_measures?id=com.github.spotbugs:sonar-findbugs-plugin&metric=coverage)
 
 ## Description / Features
@@ -73,4 +73,4 @@ Findbugs Plugin version|Embedded SpotBugs/Findbugs version|Embedded Findsecbugs
 4.2.6 | 4.8.2 (SpotBugs) | 1.12.0 | 7.6.2 (sb-contrib) | 1.8|7.9~|5.10.1.16922
 4.2.7 | 4.8.3 (SpotBugs) | 1.12.0 | 7.6.4 (sb-contrib) | 1.8|7.9~|5.10.1.16922
 4.2.8 | 4.8.3 (SpotBugs) | 1.13.0 | 7.6.4 (sb-contrib) | 1.8|7.9~|5.10.1.16922
-4.2.9-SNAPSHOT | 4.8.3 (SpotBugs) | 1.13.0 | 7.6.4 (sb-contrib) | 1.8|7.9~|5.10.1.16922
+4.2.9-SNAPSHOT | 4.8.4 (SpotBugs) | 1.13.0 | 7.6.4 (sb-contrib) | 1.8|7.9~|5.10.1.16922
diff --git a/generate_profiles/BuildXmlFiles.groovy b/generate_profiles/BuildXmlFiles.groovy
@@ -8,13 +8,13 @@ import groovy.json.JsonSlurper;
 
 @Grapes([
 
- @Grab(group='com.github.spotbugs', module='spotbugs', version='4.8.3'),
+ @Grab(group='com.github.spotbugs', module='spotbugs', version='4.8.4'),
  @Grab(group='com.mebigfatguy.sb-contrib', module='sb-contrib', version='7.6.4'),
  @Grab(group='com.h3xstream.findsecbugs' , module='findsecbugs-plugin', version='1.13.0')]
 )
 
 
-FB = new Plugin(groupId: 'com.github.spotbugs', artifactId: 'spotbugs', version: '4.8.3')
+FB = new Plugin(groupId: 'com.github.spotbugs', artifactId: 'spotbugs', version: '4.8.4')
 CONTRIB = new Plugin(groupId: 'com.mebigfatguy.sb-contrib', artifactId: 'sb-contrib', version: '7.6.4')
 FSB = new Plugin(groupId: 'com.h3xstream.findsecbugs', artifactId: 'findsecbugs-plugin', version: '1.13.0')
 

diff --git a/pom.xml b/pom.xml
@@ -52,7 +52,7 @@
  Also need to update profiles, see ./generate_profiles/README.md for detail.
  Update the version table and the rules count badge in README.md
  -->
- <spotbugs.version>4.8.3</spotbugs.version>
+ <spotbugs.version>4.8.4</spotbugs.version>
  <sbcontrib.version>7.6.4</sbcontrib.version>
  <findsecbugs.version>1.13.0</findsecbugs.version>
 

diff --git a/src/main/java/org/sonar/plugins/findbugs/rules/FindbugsRulesDefinition.java b/src/main/java/org/sonar/plugins/findbugs/rules/FindbugsRulesDefinition.java
@@ -28,7 +28,7 @@ public final class FindbugsRulesDefinition implements RulesDefinition {
 
  public static final String REPOSITORY_KEY = "findbugs";
  public static final String REPOSITORY_NAME = "FindBugs";
- public static final int RULE_COUNT = 476;
+ public static final int RULE_COUNT = 483;
  public static final int DEACTIVED_RULE_COUNT = 6;
 
  @Override

diff --git a/src/main/resources/org/sonar/plugins/findbugs/profile-findbugs-and-fb-contrib.xml b/src/main/resources/org/sonar/plugins/findbugs/profile-findbugs-and-fb-contrib.xml
@@ -1370,6 +1370,27 @@
  <Match>
  <Bug pattern='MC_OVERRIDABLE_METHOD_CALL_IN_CLONE' />
  </Match>
+ <Match>
+ <Bug pattern='MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_IMPLEMENTS_CLONEABLE' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_INDIRECTLY_IMPLEMENTS_CLONEABLE' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_IMPLEMENTS_CLONE_METHOD' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_IMPLEMENTS_SERIALIZABLE' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_GETTER_NOT_SYNCHRONIZED' />
+ </Match>
  <Match>
  <Bug pattern='SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA' />
  </Match>

diff --git a/src/main/resources/org/sonar/plugins/findbugs/profile-findbugs-only.xml b/src/main/resources/org/sonar/plugins/findbugs/profile-findbugs-only.xml
@@ -1370,6 +1370,27 @@
  <Match>
  <Bug pattern='MC_OVERRIDABLE_METHOD_CALL_IN_CLONE' />
  </Match>
+ <Match>
+ <Bug pattern='MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_IMPLEMENTS_CLONEABLE' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_INDIRECTLY_IMPLEMENTS_CLONEABLE' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_IMPLEMENTS_CLONE_METHOD' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_IMPLEMENTS_SERIALIZABLE' />
+ </Match>
+ <Match>
+ <Bug pattern='SING_SINGLETON_GETTER_NOT_SYNCHRONIZED' />
+ </Match>
  <Match>
  <Bug pattern='SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA' />
  </Match>

diff --git a/src/main/resources/org/sonar/plugins/findbugs/rules-findbugs.xml b/src/main/resources/org/sonar/plugins/findbugs/rules-findbugs.xml
@@ -4560,6 +4560,13 @@ If the object is, indeed, non-serializable, an error will result.
  <description>&lt;p&gt;
 This format string includes a newline character (\n). In format strings, it is generally
  preferable to use %n, which will produce the platform-specific line separator.
+
+ When using text blocks introduced in Java 15, use the &lt;code&gt;\&lt;/code&gt; escape sequence:
+
+&lt;code&gt;String value = """
+ first line%n\
+ second line%n\
+ """;&lt;/code&gt;
 &lt;/p&gt;</description>
  <tag>bad-practice</tag>
  </rule>
@@ -5651,6 +5658,94 @@ object explicitly.&lt;/p&gt;</description>
  &lt;/p&gt;</description>
  <tag>malicious-code</tag>
  </rule>
+ <rule key='MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT' priority='INFO'>
+ <name>Malicious code - An overridable method is called from the readObject method.</name>
+ <configKey>MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT</configKey>
+ <description>&lt;p&gt;
+ The readObject() method must not call any overridable methods. Invoking overridable methods from the readObject()
+ method can provide the overriding method with access to the object's state before it is fully initialized. This
+ premature access is possible because, in deserialization, readObject plays the role of object constructor and
+ therefore object initialization is not complete until readObject exits.&lt;/p&gt;
+ &lt;p&gt;
+ &lt;br/&gt;
+ See SEI CERT rule &lt;a href="https://wiki.sei.cmu.edu/confluence/display/java/SER09-J.+Do+not+invoke+overridable+methods+from+the+readObject%28%29+method"&gt;
+ SER09-J. Do not invoke overridable methods from the readObject() method&lt;/a&gt;.
+ &lt;/p&gt;</description>
+ <tag>malicious-code</tag>
+ </rule>
+ <rule key='SING_SINGLETON_IMPLEMENTS_CLONEABLE' priority='MAJOR'>
+ <name>Correctness - Class using singleton design pattern directly implements Cloneable interface.</name>
+ <configKey>SING_SINGLETON_IMPLEMENTS_CLONEABLE</configKey>
+ <description>&lt;p&gt;
+ If a class using singleton design pattern directly implements the Cloneable interface, it is possible to create a copy of the object, thus violating the singleton pattern.&lt;br&gt;
+ Therefore, implementing the Cloneable interface should be avoided.&lt;br&gt;&lt;br&gt;
+
+ For more information, see: &lt;a href="https://wiki.sei.cmu.edu/confluence/display/java/MSC07-J.+Prevent+multiple+instantiations+of+singleton+objects"&gt;SEI CERT MSC07-J&lt;/a&gt;.
+ &lt;/p&gt;</description>
+ <tag>correctness</tag>
+ <tag>bug</tag>
+ </rule>
+ <rule key='SING_SINGLETON_INDIRECTLY_IMPLEMENTS_CLONEABLE' priority='MAJOR'>
+ <name>Correctness - Class using singleton design pattern indirectly implements Cloneable interface.</name>
+ <configKey>SING_SINGLETON_INDIRECTLY_IMPLEMENTS_CLONEABLE</configKey>
+ <description>&lt;p&gt;
+ If a class using singleton design pattern indirectly implements the Cloneable interface, it is possible to create a copy of the object, thus violating the singleton pattern.&lt;br&gt;
+ Therefore, implementing the Cloneable interface should be avoided. If that's not possible because of an extended super-class, the solution would be overriding the clone method to unconditionally throw CloneNotSupportedException.&lt;br&gt;&lt;br&gt;
+
+ For more information, see: &lt;a href="https://wiki.sei.cmu.edu/confluence/display/java/MSC07-J.+Prevent+multiple+instantiations+of+singleton+objects"&gt;SEI CERT MSC07-J&lt;/a&gt;.
+ &lt;/p&gt;</description>
+ <tag>correctness</tag>
+ <tag>bug</tag>
+ </rule>
+ <rule key='SING_SINGLETON_IMPLEMENTS_CLONE_METHOD' priority='MAJOR'>
+ <name>Correctness - Class using singleton design pattern implements clone() method without being an unconditional CloneNotSupportedException-thrower.</name>
+ <configKey>SING_SINGLETON_IMPLEMENTS_CLONE_METHOD</configKey>
+ <description>&lt;p&gt;
+ This class is using singleton design pattern and does not implement the Cloneable interface, but implements the clone() method without being an unconditional CloneNotSupportedException-thrower. 
+ With that, it is possible to create a copy of the object, thus violating the singleton pattern.&lt;br&gt;
+ Therefore, implementing the clone method should be avoided, otherwise the solution would be overriding the clone method to unconditionally throw CloneNotSupportedException.&lt;br&gt;&lt;br&gt;
+
+ For more information, see: &lt;a href="https://wiki.sei.cmu.edu/confluence/display/java/MSC07-J.+Prevent+multiple+instantiations+of+singleton+objects"&gt;SEI CERT MSC07-J&lt;/a&gt;.
+ &lt;/p&gt;</description>
+ <tag>correctness</tag>
+ <tag>bug</tag>
+ </rule>
+ <rule key='SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR' priority='MAJOR'>
+ <name>Correctness - Class using singleton design pattern has non-private constructor.</name>
+ <configKey>SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR</configKey>
+ <description>&lt;p&gt;
+ This class is using singleton design pattern and has non-private constructor (please note that a default constructor might exist which is not private). Given that, it is possible to create a copy of the object, thus violating the singleton pattern.&lt;br&gt;
+ The easier solution would be making the constructor private.&lt;br&gt;&lt;br&gt;
+
+ &lt;a href="https://wiki.sei.cmu.edu/confluence/display/java/MSC07-J.+Prevent+multiple+instantiations+of+singleton+objects"&gt;SEI CERT MSC07-J&lt;/a&gt; rule
+ &lt;/p&gt;</description>
+ <tag>correctness</tag>
+ <tag>bug</tag>
+ </rule>
+ <rule key='SING_SINGLETON_IMPLEMENTS_SERIALIZABLE' priority='MAJOR'>
+ <name>Correctness - Class using singleton design pattern directly or indirectly implements Serializable interface.</name>
+ <configKey>SING_SINGLETON_IMPLEMENTS_SERIALIZABLE</configKey>
+ <description>&lt;p&gt;
+ This class (using singleton design pattern) directly or indirectly implements the Serializable interface, which allows the class to be serialized.&lt;br&gt;
+ Deserialization makes multiple instantiation of a singleton class possible, and therefore should be avoided.&lt;br&gt;&lt;br&gt;
+
+ &lt;a href="https://wiki.sei.cmu.edu/confluence/display/java/MSC07-J.+Prevent+multiple+instantiations+of+singleton+objects"&gt;SEI CERT MSC07-J&lt;/a&gt; rule
+ &lt;/p&gt;</description>
+ <tag>correctness</tag>
+ <tag>bug</tag>
+ </rule>
+ <rule key='SING_SINGLETON_GETTER_NOT_SYNCHRONIZED' priority='MAJOR'>
+ <name>Correctness - Instance-getter method of class using singleton design pattern is not synchronized.</name>
+ <configKey>SING_SINGLETON_GETTER_NOT_SYNCHRONIZED</configKey>
+ <description>&lt;p&gt;
+ Instance-getter method of class using singleton design pattern is not synchronized. When this method is invoked by two or more threads simultaneously, 
+ multiple instantiation of a singleton class becomes possible.&lt;br&gt;&lt;br&gt;
+
+ &lt;a href="https://wiki.sei.cmu.edu/confluence/display/java/MSC07-J.+Prevent+multiple+instantiations+of+singleton+objects"&gt;SEI CERT MSC07-J&lt;/a&gt; rule
+ &lt;/p&gt;</description>
+ <tag>correctness</tag>
+ <tag>bug</tag>
+ </rule>
  <rule key='SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA' priority='MAJOR'>
  <name>Multi-threading - Instance level lock was used on a shared static data</name>
  <configKey>SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA</configKey>

diff --git a/src/test/java/org/sonar/plugins/findbugs/FindbugsProfileImporterTest.java b/src/test/java/org/sonar/plugins/findbugs/FindbugsProfileImporterTest.java
@@ -132,7 +132,7 @@ void shouldImportCategories() {
  BuiltInQualityProfile profile = context.profile(Java.KEY, TEST_PROFILE);
  Collection<BuiltInActiveRule> results = profile.rules();
 
- assertThat(results).hasSize(153);
+ assertThat(results).hasSize(159);
  assertThat(findActiveRule(profile, FindbugsRulesDefinition.REPOSITORY_KEY, "BC_IMPOSSIBLE_DOWNCAST")).isNotNull();
  }
 
@@ -182,7 +182,7 @@ void testImportingUncorrectXmlFile() {
  @ParameterizedTest
  @CsvSource({
  "/org/sonar/plugins/findbugs/findbugsXmlWithUnknownRule.xml,1",
- "/org/sonar/plugins/findbugs/findbugsXmlWithUnknownCategory.xml,153",
+ "/org/sonar/plugins/findbugs/findbugsXmlWithUnknownCategory.xml,159",
  "/org/sonar/plugins/findbugs/findbugsXmlWithUnknownCode.xml,12"})
  void profileImport(String profilePath, int expectedSize) {
  NewBuiltInQualityProfile newProfile = context.createBuiltInQualityProfile(TEST_PROFILE, Java.KEY);