What is FindBugs?

•    FindBugsis an open source static analysis tool that analyzes Java class files

•    http://findbugs.sourceforge.net/

•    Developed from Research at University of Maryland, led by Bill Pugh

•    Looks for  for programming defects based on  ~ 300 different bug patterns from real bugs

•    bug patterns are grouped into categories: correctness, bad practice, performance…

•    each pattern assigned a priority: high, medium or low.

•    High-Medium priority have low false positive rates: effort was put into trying to ensure that issues reported as high or medium priority correctness issues were issues that had a low false positive rate, and that developers would be interested inexamining all issues reported as high or medium priority correctness issues, even in large code bases.

FindBugslooks for  Bugs  based on real bug Patterns:

•     broad and common patterns:

•     a read or write on a null pointer

•     typos

•     Methods whose return value should not be ignored

•     Also specific bug patterns:

•     Every Programming Puzzler

•     Eclipse documented bug fixes

•     Every chapter inEffective Java

•     lots from Worse than failure: http://thedailywtf.com/

Misconceptions about Bugs:

•    Programmers are smart

•    Smart people don’t make dumb mistakes

•    WRONG!

•    Smart people make dumb mistakes

•    Common errors:

•    wrong booleanoperator, forgetting parentheses, etc. Misunderstood class or method !

Who uses Findbugs?

•    Developed from Research at University of Maryland

•    Google, Ebay, Sun, Wells Fargo…

•    Bill Pugh , Professor from University of Maryland, spent a year sabbatical at Google  working Findbugs  into their development process:

•    Google runs FindBugs over all Java code

•    1800s issues identified, > 600 fixed.

•    Ebay found 2 developers reviewing  Findbugs  was 10 times more effective than 2 testers

Some Bug Categories

• Correctness - the code is doing something wrong, you should look at it

• Bad practice - the code violates good practice

•     Dodgy Code

•     Concurrency

•     Performance

• Security defect

Can you find the Bug below ?

publicStringsendMessage (User user, String body, Date time) {

    return sendMessage(user, body, null);

  }

publicStringsendMessage (User user, String body, Date time, List attachments) {

   String xml = buildXML (body, attachments);

   String response = sendMessage(user, xml);

   return response;

  }

This line causes an Infinite recursive loop. This bug is  high priority,  in the correctness category.

returnsendMessage(user, body, null);

Can you find the Bug below ?

publicStringfoundType() {

   return this.foundType();

}

Should be

publicStringfoundType() {

   return this.foundType;

}

This is another example of an infinite recursive loop. This bug is found often  in a decorator pattern when you forget to delegate to another method

 Findbugs found 5 infinite recursive loopsin JDK1.6.0-b13. Including this one written by Joshua Bloch

• Smart people make dumb mistakes

• 27 across all versions of JDK, 31 in Google’s Java code

• Embrace and fix your dumb mistakes!

Can you find the Bug?

if(name != null || name.length > 0)

Should be

if(name != null && name.length > 0)

this null pointer bug was found in com.sun.corba…

Can you find the Bug?
privatefinal String _lock = "LOCK";
...
synchronized(_lock)
{
...
}

Constant Strings are shared (even private ones) across all other classes loaded by the JVM. This could lead to unexpected deadlocks in conjunction with other code. This bug was found in Jetty.

This null pointer bug was in Eclipse since 3.2:

if(adapters == null && adapters.length == 0)

     return;

•example of  statement orbranch that if executed guarantee that a null pointer exception will occur

but in this case adapters is probably never null, that’s why it didn’t get noticed.

•     somemistakes don’t matter much, because  the impact of the mistake is minimal.

•null pointer exceptions usually get noticed. A harder error to find is that it won’t return if the length is 0.

Can you find the bug?

try{ ... }

catch(IOException e) {

  newSAXException("Server side Exception:" + e);

}

The Exception is created and dropped rather than thrown, Should be :

  thrownew SAXException("Server side Exception:" + e);

Can you find the Bug?

publicstatic String getNameById(String userId) {

    String str = userId;

    str.replace(' ', '_');

    return str;

  }

Ignores the return value of the replace() method, Should be:

     str= str.replace(' ', '_');

A very common mistake is ignoring the return value on methods whose return value shouldn't be ignored.

• Strings are immutable, so functions like trim() and replace() return a new String.

What does this Print?

Integer one = 1;

Long addressTypeCode = 1L;

if(addressTypeCode.equals(one)) {

     System.out.println("equals");

} else {

     System.out.println("not equals");

}

It prints "not equals". According to the contract of equals(), objects of different classes should always compare as unequal

Incomparable equality:

•     Using .equals to compare incompatible types

•     Using .equals to compare arrays

•     only checks if the same array

•     Checking to see if a Set<Long> contains anInteger

•     never found, even if the same integral value is contained in the map

•     Calling get(String)on a Map<Integer,String>

•     Returns false , not an error

     These bugs may be hard to find on your own

•     Types not always explicit

•     May be introduced by refactoring

           For example a Google refactoring changed a method to return byte[ ] rather than String

Bugs that Matter…

You can have mistakes which don't actually cause problems. Bugs that matter depend on the context.  Not every bug found matters, but the effective use of Findbugs can remove bugs cheaper than with other methods

What is the best way to use Findbugs?

You want to find an effective way to use static analysis to improve software quality. 5-10% of mistakes can be found with Findbugs, for some types of bugs it can find all of them.  Testing and running code in production will find the bugs that matter, the bugs that cause problems .  If you run Findbugs on code in production , then a lot of bugs have been fixed, if you run on new code your are more likely to find bugs. The reason to use findbugs is not to fix all your quality problems, but rather for the issues it does find,  finding and fixing with Findbugs is cheaper than finding with testing or causing a problem in production.

•     Use Findbugs on new code to remove bugs cheaplybefore bugs are detected using more expensive techniques

•     The best time to have a developer  look at a warning is when it is introduced, while the code is fresh in a developer’s head.

Expensive Mistakes are …

•     Mistakes that fail silently

•     Bugs that silently cause the wrong answer to be computed are the scariest bugs, because they will not be noticed easily .

•     Mistakes that cause loss of money when they occur

•     Mistakes that are hard to fix

Mistakes that matter ($$)  can be found by testing or eventually in production,  but it is cost effective to find bugs  before testing and production with findbugs.

Runtime exceptions can be your friend… runtime exceptions can point you right where the error is

If a mistake causes a runtime exception, then the mistake will be found and corrected .

Throwing a runtime exception is often a reasonable way to fail safely and report a failure.

Runtime exceptions represent conditions that reflect errors in your program's logic and cannot be reasonably recovered from

Can you find the Bug?

// calculate DR amount by aggregating CR amounts

BigDecimaldrAmount = new BigDecimal(0);

for(JournalEntry je: journalEntries)

     drAmount.add(je.getCrAmount());

     // persist to db

     getTrxnService().saveJournalEntry(id,

        drAmount, // aggregated amount

        true, // Debit

        "USD",

        "Revenue");

Ignores return value of BigDecimal.add(), should be

 drAmount=drAmount.add(je.getCrAmount());

This bug would have cost $ in production, but fixed at Google, within 30 minutes of being reported.

Can you find the Bug?

intvalue2;

Public boolean equals(Integer value1){

  returnvalue1== intValue() ;

}

publicInteger intValue() {

  returnvalue2;

}

Uses reference equality rather than .equals, should be:

Public boolean equals(Integer value1){

  returnvalue1.equals(intValue() );

}

For boxed primitives, == and != are computed using pointer equality, but <, <=, >, >= are computed by comparing unboxed primitive values. This can bite you on other classes (e.g., String), but boxed primitives is where people get bit

Concurrency Bugs

•     Inconsistent synchronization –

•     a lock is held   sometimes when field accessed

•     Problems with wait/notify –

•     e.g., call to wait() not in loop

•     unsafe lazy initialization of static field

Can you find the bug?

synchronized(object) {

  if (<condition does not hold>) {

    object.wait();

  }

  //Proceed when condition holds

}

Should be:

synchronized(object) {

  while (<condition does not hold>) {

    object.wait();

  }

  //Proceed when condition holds

}

Use Java 5!  simplified concurrency , less likely to make these mistakes.

Running FindBugs

•     Eclipse plugin

           http://findbugs.sourceforge.net/manual/eclipse.html

•     Run with Hudson build

References:

•     Findbugs home page

           http://findbugs.sourceforge.net/

•     Bill Pugh Findbugs Devoxxtalk

           http://www.parleys.com/#id=2106&st=5

•     Bill Pugh Oredev talk:

           http://oredev.org/2010/sessions/defective-java-mistakes-that-matter

Examples

• file is accepted from the user without validating content
• filename is accepted from the user

// get the absolute file path on the server's filesystem 
String dir = servlet.getServletContext().getRealPath("/ebanking")
// get input file name
String file = request.getParameter(“file”); 
// Create a new File instance from pathname string   
File f = new File((dir + "\\" + file).replaceAll("\\\\", "/")); 

• files loaded from another server and executed within the context of the web server
• modifying paths to gain access to directories on the web server
• malicious scripts put into a directory with inadequate access controls

Protecting against Malicious File Execution

• the Java EE Security Manager should be properly configured to not allow access to files outside the web root.
• do not allow user input to influence the path name for server resources 
  • Inspect code containing a file open, include, create, delete...
• firewall rules should prevent new outbound connections to external web sites or internally back to any other server. Or isolate the web server in a private subnet
• Upload files to a destination outside of the web application directory. 
  • Enable virus scan on the destination directory.

Java specific Protecting against Malicious File Exection

Use the OWASP ESAPI  HTTPUtilities interface:

• The ESAPI HTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, responses, sessions, cookies, headers, and logging.
  
  The HTTPUtilities getSafeFileUploads method uses the Apache Commons FileUploader to parse the multipart HTTP request and extract any files therein
   
      

  public class HTTPUtilities     public void getSafeFileUploads(java.io.File tempDir,                                java.io.File finalDir)                         throws ValidationException

• Top 10 most critical web application security vulnerabilities
• Open Web Application Security Project (OWASP)
• OWASP TOP 10 FOR JAVA EE
• OWASP Enterprise Security API
• OWASP ESAPI  Overview Presentation

OWASP Top 10 number 1: XSS = Cross Site Scripting

• Reflected XSS: is when an html page reflects user input data, e.g. from HTTP query parameters or a HTML form, back to the browser, without properly sanitizing the response. Below is an example of this in a servlet:
  
      

  out.writeln(

JPA Performance, Don't Ignore the Database

Database Schema

Data Types

Normalization

Database Normalization and Mapping Inheritance Hiearchies

Know what SQL is executed

• queries which execute too often to retrieve needed data
• retrieving more data than needed
• queries which are too slow 
  • you can use EXPLAIN to see where you should add indexes

Understanding EXPLAIN

Lazy Loading and JPA

Partitioning

Vertical Partitioning

Horizontal Partitioning

Hibernate Shards

Caching

• read often
• modified infrequently
• Not critical if stale

References and More Information:

• Download the sample code

Explanation of the usage of JSF 2.0 and Java EE 6 in a sample Store Catalog Application

JSF 2.0 Facelets XHTML instead of JSP

JSF 2.0 Annotations instead of XML configuration

Java EE 6: JSF 2.0,  EJB 3.1, and Java Persistence API (JPA)  2.0

The Java Persistence Query APIs are used to create and execute queries that can return a list of results.  The JPA Query interface provides support for pagination via the setFirstResult() and setMaxResults() methods: q.setMaxResults(int maxResult) sets the maximum number of results to retrieve.q.setFirstResult(int startPosition) sets the position of the first result to retrieve.

1. annotating the class with an @Entityannotation.
   
2. annotating   the primary key identifier with @Id
   

JSF 2.0 Simplified Navigation

    

GlassFish v3 is a lightweight server

• OSGi-based; Embedded API; RESTful admin API; Lightweight and fast startup;
• iterative development cycle "edit-save-refresh browser": 
  • Incremental compile of all JSF 2.0 artifacts when you save.
  • Auto-deploy of all web or Java EE 6 artifacts
• Session retention: maintain sessions across re-deployments

Running the Sample Application

1. Download and install NetBeans IDE 6.8 M1 with GlassFish v3 b57 (Glassfish v3 preview is Java EE 6 Preview) , and MySQL Community Server .
   
2. Follow these instructions to set up a  jdbc-driver for MySQL. (Normally this is already setup with Glassfish, but I got an errror message with Glassfish v3 b57 that it was missing)
   
3. Download the sample code. Unzip the catalog.zip file which you downloaded, this will create a catalog directory with the project code.

Create the Pet Catalog database

In order to run the sample code you first have to create the Pet Catalog database and fill in  the Item table.

1. Start NetBeans IDE
   
2. Ensure that GlassFish is registered in the NetBeans IDE, as follows: 
   • Click the Services tab in the NetBeans IDE.
   • Expand the Servers node. You should see GlassFish v2 in the list of servers. If not, register GlassFish v2 as follows: 
     • Right-click the Servers node and select Add Server. This opens an Add Server Instance wizard.
     • Select GlassFish v2 in the server list of the wizard and click the Next button.
     • Enter the location information for the server and click the Next button.
     • Enter the admin name and password and click the Finish button.
3. Start the MySQL or Java DB database as follows: 
   • Click the Services tab in the NetBeans IDE.
   • Expand the databases node. You should see the Java DB database in the list of databases. If you have installed the MySQL server database, you should also see the MySQL database in the list of databases.. Note:  Java DB  comes bundled with Netbeans, you can  download MySQL separately.         
   • Right-mouse click on the Java DB or MySQL server database and select Start.
4. If you installed MySQL, set the properties of the MySQL server database as follows: 
   • Right-click on the MySQL server database and select Properties. This opens the MySQL Server Properties dialog box, as shown in Figure 8.
      
               

     Figure 8.MySQL Server Basic Properties

      
     
   • In the Basic Properties tab, enter the server host name and port number. The IDE specifies localhost as the default server host name and 3306 as the default server port number.
   • Enter the administrator user name, if not displayed, and the administrator password -- the default administrator password is blank.
   • Click the Admin Properties tab.
   • Enter an appropriate path in the Path/URL to admin tool field. You can find the path by browsing to the location of a MySQL Administration application such as the MySQL Admin Tool.
   • Enter an appropriate path in the Path to start command. You can find the path by browsing to the location of the MySQL start command. To find the start command, look for mysqld in the bin folder of the MySQL installation directory.
   • Enter an appropriate path in the Path to stop command field. You can find the path by browsing to the location of the MySQL stop command. This is usually the path to mysqladmin in thebin folder of the MySQL installation directory. If the command is mysqladmin, in the Arguments field, type-u root stop to grant root permissions for stopping the server. The Admin Properties tab should look similar to Figure 9.
      
               

     Figure 9.MySQL Server Administration Properties

      
     
   • Click the OK button.
    
   
5. Right-click on the MySQL server or Java DB database and select Start.
6. Create the petcatalog database as follows: 
   • Right-mouse click on the Java DB or MySQL server database and select Create Database. This will open a create Database window.
   • Enter the database name catalog for Java DB or petcatalog for MySQL.
     
     
     For Java DB enter userid password app app as shown below:
     
     
      Click O.K. to accept the displayed settings.
     
7. Create the tables in the catalog database as follows: 
   • Underneath Databases you should see a database connection for the petcatalog database. For example MySQL:        or Java DB:       
   • Right-mouse click on the petcatalog connection and select Connect.
   • Right-mouse click on the petcatalog connection and select Execute Command. This will open up a SQL command window.
   • Copy the contents of the catalog.sql file in thecatalog directory and paste the contents into the SQL command window, as shown in below:
      
       
   • Click the Run SQL icon (Ctrl+Shift+E) above the SQL command window.
   • Note: It is ok to see this: "Error code -1, SQL state 42Y55: 'DROP TABLE' cannot be performed on 'ITEM' because it does not exist. Line 2, column 1" . This just means you are deleting a table that does not exist.  If you need to delete and recreate the tables you will not  see this message the second time.
     
8. View the data in the Pet Catalog database Item table as follows:
    
   • Underneath Databases you should see a database connection for the petcatalog database. For example MySQL:        or Java DB:       
   • If the database connection is broken like in the following diagram:
     
      
     • Right-mouse click on the petcatalog connection and select Connect. as shown below:
       
       
     • if prompted for a password, for MySQL leave it blank, for JavaDB enter user app password app.
   • Expand the Tables node below the petcatalogdatabase in the Services window. You should see theitem table under the Tables node. You can expand theitem table node to see the table columns, indexes, and any foreign keys, as shown in below :        

     Figure 12. An Expanded Table Node

      
        You can view the contents of a table or column by right-clicking the table or column and selecting View Data as shown  below:
      
               

     Figure 13.Viewing the Contents of a Table

     
     
     
9. Follow these instructions to Create a JDBC Connection pool and JDBC resource. Name the  pool mysql_petcatalog_rootPool and the jndi resource jdbc/petcatalog. Note: you do not have to create a JDBC connection pool and resource if you use the Netbeans wizard to generate JPA entities from database tables as described in this article GlassFish and MySQL, Part 2: Building a CRUD Web Application With Data Persistence.
10. Open the catalog/setup/sun-resources.xml file and verify that the property values it specifies match those of the petcatalog database and jdbc resources you created. Edit the property values as necessary.

Running the Sample solution:

1. Open the catalog project as follows: 
   • In NetBeans IDE, click Open Project in the File menu. This opens the Open Project dialog.
   • Navigate in the Open Project dialog to thecatalog  directory and click the Open Project button.
    
   In response, the IDE opens the catalog project.  You can view the logical structure of the project in the Projects window (Ctrl-1).
2. Run the catalog by right-clicking on thecatalog project in the Projects window and selecting Run Project. The NetBeans IDE compiles the application, deploys it on Glassfish, and brings up the default page in your browser.  (at http://localhost:8080/catalog/).

For more information see the following resources:

• A Sampling of EJB 3.1
• Java EE 6 Technologies
  
• JSF 2.0 Home page Project Mojarra
• SDN JavaServer Faces Page
  
• JSF 2 fu, Part 1: Streamline Web application development
• Composite UI Components in JSF 2.0
  
• Creating Your First Java EE 6 Application
• Roger Kitain's Blog (co-spec lead for JSF 2.0)
• Ed Burns's Blog (co-spec lead for JSF 2.0)
• Cay Horstmann's Blog: JSF 2.0 specifying parameters in method expressions
  
• JavaServer Faces 2.0 Ref Card
  
• Jim Driscoll's Blog
• Top reasons why GlassFish v3 is a lightweight server
• What You Can Expect From GlassFish v3
• Beginning Java