代码扫描问题以及解决方式(转载备忘)

 

原文地址:https://blog.csdn.net/wwbmyos/article/details/50549650

 

1、LI_LAZY_INIT_UPDATE_STATIC:Incorrect lazy initialization and update of static field

 

Thismethod contains an unsynchronized lazy initialization of a static field. Afterthe field is set, the object stored into that location is further updated oraccessed. The setting of the field is visible to other threads as soon as it isset. If the futher accesses in the method that set the field serve toinitialize the object, then you have a veryseriousmultithreading bug, unless something else prevents any otherthread from accessing the stored object until it is fully initialized.

 

原因分析:

 

该方法的初始化中包含了一个迟缓初始化的静态变量。你的方法引用了一个静态变量,估计是类静态变量,那么多线程调用这个方法时,你的变量就会面临线程安全的问题了,除非别的东西阻止任何其他线程访问存储对象从直到它完全被初始化。

 

解决方法:给该方法加上synchronized同步锁,并且给有调用到该静态变量的方法也加上synchronized同步锁。

 

2、RR_NOT_CHECKED: Method ignores results ofInputStream.read()

 

This method ignores the return value ofone of the variants of java.io.InputStream.read() which can returnmultiple bytes. If the return value is not checked, the caller will notbe able to correctly handle the case where fewer bytes were read than thecaller requested. This is a particularly insidious kind of bug, becausein many programs, reads from input streams usually do read the full amount ofdata requested, causing the program to fail only sporadically.

 

原因分析:

 

InputStream.read方法忽略返回的多个字符,如果对结果没有检查就没法正确处理用户读取少量字符请求的情况。

 

解决方法:定义一个变量接收该方法返回值,如while((number = is.read(bs))!= -1) {}

 

3、RV_RETURN_VALUE_IGNORED_BAD_PRACTICE:Method ignores exceptional return value

 

This methodreturns a value that is not checked. The return value should be checked sinceit can indicate an unusual or unexpected function execution. For example, the File.delete() methodreturns false if the file could not be successfully deleted (rather thanthrowing an Exception). If you don't check the result, you won't notice if themethod invocation signals unexpected behavior by returning an atypical returnvalue.

 

原因分析:方法忽略返回值的异常信息

 

解决方法:

 

原代码:if (file.exists()) {

 

    file.delete();

 

   }

 

修改后的代码:try {

 

     file.delete();

 

    }catch(SecurityException e){

 

     Utils.logger.info(e);

 

    }catch(NullPointerException e){

 

     Utils.logger.info(e);

 

    }

 

4、SE_BAD_FIELD:Non-transient non-serializable instance field in serializable class

 

This Serializableclass defines a non-primitive instance field which is neither transient,Serializable, or java.lang.Object, and does not appear to implement theExternalizable interfaceor the readObject() and writeObject() methods. Objects of this class will not be deserialized correctly if a non-Serializableobject is stored in this field.

 

原因分析:序列化的类里面定义了一个非序列化的字段

 

解决方法:给该字段加上transient表明这是一个序列化字段

 

5、NP_NULL_ON_SOME_PATH_EXCEPTION:Possible null pointer dereference in method on exception path

 

Areference value which is null on some exception control path is dereferencedhere. This may lead to a NullPointerException when the code isexecuted. Note that because FindBugs currently does not prune infeasibleexception paths, this may be a false warning.

 

Alsonote that FindBugs considers the default case of a switch statement to be anexception

你可能感兴趣的:(代码扫描问题以及解决方式(转载备忘))