FindBugs scanning external jars

StackOverflow https://stackoverflow.com/questions/15898893

  •  02-04-2022
  •  | 
  •  

Question

I am using the following link to create an ant script to run findbugs on a web application: Chapter 6. Using the FindBugs™ Ant task

I am setting the auxClasspath parameter to my jars folder.

But when i run the task using ant findbugs from the command prompt, it takes a very long time(~45 minutes) and the output xml contains analysis of the jars in the auxClasspath as well as my source code.

I want only my source code to be analyzed.

This is the code in my build.xml:

<taskdef name="findbugs" classname="edu.umd.cs.findbugs.anttask.FindBugsTask"/>
<property name="findbugs.home" value="C:/Software/FindBugs" />
<target name="findbugs" >
    <echo message="Finding Bugs From ${basedir}/src/java"/>
    <findbugs home="${findbugs.home}"
              output="xml:withMessages"
              outputFile="${basedir}\findbugs.xml"
              stylesheet="fancy-hist.xsl"
              timeout="6000000"
              jvmargs="-Xmx1200m">
        <auxClasspath path="${basedir}/Jars/*.jar" />
        <sourcePath path="${basedir}/src/java"/>
        <class location="${basedir}/build/myApp-1.0.jar" />
    </findbugs>
</target>

I have added findbugs-ant.jar to lib of my ant installation. The findbugs directory exists.

Other information:
IDE: Netbeans 7.3
OS: Microsoft Windows XP
Ant Version: 1.8.4
Find Bugs Version: 2.0.2

Update

If i leave out this line:

<auxClasspath path="${basedir}/Jars/*.jar" />

I get my desired output(i.e. analysis of only my source code). But it raises a warning:

[findbugs] The following classes needed for analysis were missing:
[findbugs]   javax.servlet.http.HttpServlet
[findbugs]   javax.servlet.http.HttpServletRequestWrapper
[list continues]....

Any idea, why find bugs is analyzing jars which it should not analyze(according to the documentation)

Was it helpful?

Solution

I tried to track which Jars are being used in the source code.

In the findbugs xml output, i found a line: ${basedir}\Jars\antlr-2.7.2.jar

The findbugs analysis report showed that all the other jars(except antlr-2.7.2.jar) were missing.

There were no more auxClassPath entries. Solved this by specifying each class path entry in a different line.

If anyone has any better ideas, kindly contribute.

OTHER TIPS

I used the following auxClasspath settings to pull in all my jars in my lib folder and all the jars in directories under my lib folder.

<auxClasspath>
    <fileset dir="${lib.dir}">
        <include name="*/**"/>
        <include name="*.jar"/>
    </fileset>
</auxClasspath>

Place it inside the findbugs tag.

Try to remove this line

<class location="${basedir}/build/myApp-1.0.jar" />

Now to try to analyze both jar and source files, that's it takes so long time.

This line is needed and used to find a class if it encounters during analysis of your source.

<auxClasspath path="${basedir}/Jars/*.jar" />

Maybe to can limit it to only really needed jars, not all in the folder.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top