Merge branch 'master' into SEI_CERT_EXP06_J

.github/workflows/build.yml

@@ -7,25 +7,28 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
       - name: Set up JDK 17
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v3
         with:
           java-version: '17'
           distribution: temurin
           cache: gradle
       - uses: gradle/wrapper-validation-action@v1
       - name: Download Eclipse
         run: |
-          wget -nv 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.6.3-201703010400/eclipse-SDK-4.6.3-linux-gtk-x86_64.tar.gz&r=1' -O eclipse-SDK-4.6.3-linux-gtk-x86_64.tar.gz
-          tar xzf eclipse-SDK-4.6.3-linux-gtk-x86_64.tar.gz eclipse
+          wget -nv 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.14-201912100610/eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz&r=1' -O eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz
+          tar xzf eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz eclipse
           echo "eclipseRoot.dir=$(pwd)/eclipse" | tee eclipsePlugin/local.properties
       - name: Build
         # https://community.sonarsource.com/t/sonarcloud-now-not-updating-github-pr-and-checks/6595/17

.github/workflows/release.yml

@@ -5,23 +5,28 @@ on:
     tags:
       - '**'
 
+permissions: {}
 jobs:
   build:
+    permissions:
+      contents: write # to push pages branch (peaceiris/actions-gh-pages)
+
+    if: github.repository_owner == 'spotbugs'
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up JDK 17
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v3
         with:
           java-version: '17'
           distribution: temurin
           cache: gradle
       - uses: gradle/wrapper-validation-action@v1
       - name: Download Eclipse
         run: |
-          wget 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.6.3-201703010400/eclipse-SDK-4.6.3-linux-gtk-x86_64.tar.gz&r=1' -O eclipse-SDK-4.6.3-linux-gtk-x86_64.tar.gz
-          tar xzvf eclipse-SDK-4.6.3-linux-gtk-x86_64.tar.gz eclipse
+          wget 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.14-201912100610/eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz&r=1' -O eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz
+          tar xzvf eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz eclipse
           echo "eclipseRoot.dir=$(pwd)/eclipse" > eclipsePlugin/local.properties
       - name: Build
         run: |

CHANGELOG.md

@@ -4,7 +4,59 @@ This is the changelog for SpotBugs. This follows [Keep a Changelog v1.0.0](http:
 
 Currently the versioning policy of this project follows [Semantic Versioning v2.0.0](http://semver.org/spec/v2.0.0.html).
 
-## Unreleased - 2022-??-??
+## Unreleased - 2023-??-??
+### Changed
+- Bump up Apache Commons BCEL to the version 6.6.1 ([#2223](https://github.com/spotbugs/spotbugs/pull/2223))
+- Bump up slf4j-api to 2.0.3 ([#2220](https://github.com/spotbugs/spotbugs/pull/2220))
+- Bump up gson to 2.10 ([#2235](https://github.com/spotbugs/spotbugs/pull/2235))
+
+### Fixed
+- Fixed missing classes not in report if using IErrorLogger.reportMissingClass(ClassDescriptor) ([#219](https://github.com/spotbugs/spotbugs/issues/219))
+- Stop exposing junit-bom to consumers ([#2255](https://github.com/spotbugs/spotbugs/pull/2255))
+- Fixed AbstractBugReporter emits wrong non-sensical debug output during filtering ([#184](https://github.com/spotbugs/spotbugs/issues/184))
+- Added support for jakarta namespace ([#2289](https://github.com/spotbugs/spotbugs/pull/2289))
+- Report a low priority bug for an unread field in reflective classes ([#2325](https://github.com/spotbugs/spotbugs/issues/2325))
+- Fixed "Unhandled event loop exception" opening Bug Filter Configuration dialog in Eclipse ([#2327](https://github.com/spotbugs/spotbugs/issues/2327))
+- Fixed detector `RandomOnceSubDetector` to not report when `doubles`, `ints`, or `longs` are called on a new `Random` or `SecureRandom` ([#2370](https://github.com/spotbugs/spotbugs/issues/2325))
+
+### Added
+* New simple name-based AnnotationMatcher for exclude files (now bug annotations store the class java annotations in an attribute called `classAnnotationNames`). For example, use like <Match><Annotation name="org.immutables.value.Generated" /></Match> in an excludeFilter.xml to ignore classes generated by the Immutable framework. This ignores all class, method or field bugs in classes with that annotation.
+
+### Security
+- Disable access to external entities when processing XML ([#2217](https://github.com/spotbugs/spotbugs/pull/2217))
+
+### Build
+- Bump Eclipse from 4.6.3 to 4.14 ([#2314](https://github.com/spotbugs/spotbugs/pull/2314))
+- Use jakarta annotation 1.3.5 instead of legacy javax annotation 1.3.2 ([#2315](https://github.com/spotbugs/spotbugs/pull/2315))
+- Change hamcrest-all to hamcrest-core as that is what was actually used and then update to 2.2 ([#2316](https://github.com/spotbugs/spotbugs/pull/2316))
+- Only run release action on 'spotbugs' and use Eclipse 4.14 ([#2317](https://github.com/spotbugs/spotbugs/pull/2317))
+
+## 4.7.3 - 2022-10-15
+### Fixed
+- Fixed detector `DontUseFloatsAsLoopCounters` to prevent false positives. ([#2126](https://github.com/spotbugs/spotbugs/issues/2126))
+- Fixed regression in `4.7.2` caused by ([#2141](https://github.com/spotbugs/spotbugs/pull/2141))
+- improve compatibility with later version of jdk (>= 13). ([#2188](https://github.com/spotbugs/spotbugs/issues/2188))
+- Fixed detector `UncallableMethodOfAnonymousClass` to not report unused methods of method-local enumerations and records ([#2120](https://github.com/spotbugs/spotbugs/issues/2120))
+- Fixed detector `FindSqlInjection` to detect bug `SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE SQL` with high priority in case of unsafe appends also in Java 11 and above ([#2183](https://github.com/spotbugs/spotbugs/issues/2183))
+- Fixed detector `StringConcatenation` to detect bug `SBSC_USE_STRINGBUFFER_CONCATENATION` also in Java 11 and above ([#2182](https://github.com/spotbugs/spotbugs/issues/2182))
+- Fixed `OpcodeStackDetector` to to handle propagation of taints properly in case of string concatenation in Java 9 and above ([#2195](https://github.com/spotbugs/spotbugs/issues/2195))
+- Bump up log4j2 binding to `2.19.0`
+- Bump ObjectWeb ASM from 9.3 to 9.4 supporting JDK 20 ([#2200](https://github.com/spotbugs/spotbugs/pull/2200))
+- Bump up commons-text to 1.10.0 ([#2197](https://github.com/spotbugs/spotbugs/pull/2197))
+- Fixed debug detector `ViewCFG` to generate file names that are also valid on Windows ([#2209](https://github.com/spotbugs/spotbugs/issues/2209))
+
+## 4.7.2 - 2022-09-02
+### Fixed
+- Bumped gson from 2.9.0 to 2.9.1 ([#2136](https://github.com/spotbugs/spotbugs/pull/2136))
+- Bump up SLF4J API to `2.0.0`
+- Bump up logback to `1.4.0`
+- Bump up log4j2 binding to `2.18.0`
+- Bump up Saxon-HE to `11.4` ([#2160](https://github.com/spotbugs/spotbugs/pull/2160))
+- Fixed InvalidInputException in Eclipse while bug reporting ([#2134](https://github.com/spotbugs/spotbugs/issues/2134))
+- Bug `SA_FIELD_SELF_ASSIGNMENT` is now reported from nested classes as well ([#2142](https://github.com/spotbugs/spotbugs/issues/2142))
+- Avoid warning on use of security manager on Java 17 and newer. ([#1579](https://github.com/spotbugs/spotbugs/issues/1579))
+- Fixed false positives `EI_EXPOSE_REP` thrown in case of fields initialized by the `of` or `copyOf` method of a `List`, `Map` or `Set` ([#1771](https://github.com/spotbugs/spotbugs/issues/1771))
+- Fixed CFGBuilderException thrown when `dup_x2` is used to swap the reference and wide-value (double, long) in the stack ([#2146](https://github.com/spotbugs/spotbugs/pull/2146))
 
 ### Added
 - New detector `FindAssertionsWithSideEffects` detecting bug `ASSERTION_WITH_SIDE_EFFECT` and `ASSERTION_WITH_SIDE_EFFECT_METHOD` in case of assertions which may have side effects (See [EXP06-J. Expressions used in assertions must not produce side effects](https://wiki.sei.cmu.edu/confluence/display/java/EXP06-J.+Expressions+used+in+assertions+must+not+produce+side+effects))

build.gradle

@@ -1,13 +1,13 @@
 plugins {
-  id "org.sonarqube" version "3.4.0.2513"
-  id "com.diffplug.spotless" version "6.5.2"
+  id "org.sonarqube" version "3.5.0.2730"
+  id "com.diffplug.spotless" version "6.14.0"
   id "org.gradle.crypto.checksum" version "1.4.0"
-  id "com.github.spotbugs" version "5.0.8"
-  id "io.github.gradle-nexus.publish-plugin" version "1.1.0"
+  id "com.github.spotbugs" version "5.0.14"
+  id "io.github.gradle-nexus.publish-plugin" version "1.3.0"
 }
 
 group = 'com.github.spotbugs'
-version = '4.7.2-SNAPSHOT'
+version = '4.7.4-SNAPSHOT'
 
 apply from: "$rootDir/gradle/java.gradle"
 apply from: "$rootDir/gradle/jacoco.gradle"
@@ -37,14 +37,12 @@ allprojects {
     mavenCentral()
   }
   dependencies {
-    implementation platform('org.junit:junit-bom:5.8.2')
+    def junitVersion = '5.9.3'
+    compileOnly platform("org.junit:junit-bom:$junitVersion")
+    testImplementation platform("org.junit:junit-bom:$junitVersion")
   }
 }
 
-wrapper {
-  distributionType = Wrapper.DistributionType.ALL
-}
-
 // https://discuss.gradle.org/t/merge-jacoco-coverage-reports-for-multiproject-setups/12100/6
 task jacocoRootReport(type: JacocoReport) {
   description = 'Merge all coverage reports before submit to SonarQube'

buildSrc/build.gradle.kts

@@ -6,5 +6,5 @@ repositories {
     gradlePluginPortal()
 }
 dependencies {
-    implementation("com.diffplug.gradle:goomph:3.37.1")
+    implementation("com.diffplug.gradle:goomph:3.41.1")
 }

buildSrc/src/main/kotlin/constraints.gradle.kts

@@ -7,14 +7,12 @@ dependencies {
         implementation("org.apache.logging.log4j:log4j-core") {
             version {
                 strictly("[2.17.1, 3[")
-                prefer("2.17.1")
             }
             because("CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832: Log4j vulnerable to remote code execution and other critical security vulnerabilities")
         }
         implementation("ch.qos.logback:logback-core") {
             version {
                 strictly("[1.2.9, 2[")
-                prefer("1.2.10")
             }
             because("CVE-2021-42550: Logback vulnerable to remote code execution vulnerabilities")
         }

docs/Dockerfile

@@ -2,7 +2,7 @@
 # Run `docker build -t spotbugs-sphinx .` to build docker image,
 # and run `docker run -it -v $(pwd):/documents spotbugs-sphinx make html` to generate documents.
 
-FROM sphinxdoc/sphinx:4.1.2
+FROM sphinxdoc/sphinx:5.3.0
 
 WORKDIR /docs/docs
 RUN pip3 install --upgrade pip

docs/conf.py

@@ -17,10 +17,10 @@
 
 html_context = {
   'version' : '4.7',
-  'full_version' : '4.7.1',
-  'maven_plugin_version' : '4.7.0.0',
-  'gradle_plugin_version' : '5.0.8',
-  'archetype_version' : '0.2.4'
+  'full_version' : '4.7.3',
+  'maven_plugin_version' : '4.7.2.1',
+  'gradle_plugin_version' : '5.0.12',
+  'archetype_version' : '0.2.3'
 }
 
 # If extensions (or modules to document with autodoc) are in another directory,

docs/locale/ja/LC_MESSAGES/bugDescriptions.po

@@ -541,7 +541,7 @@ msgstr ""
 
 #: ../../generated/bugDescriptionList.inc:524
 msgid ""
-"  <p> This code negatives the return value of a compareTo or compare "
+"  <p> This code negates the return value of a compareTo or compare "
 "method.\n"
 "This is a questionable or bad programming practice, since if the return\n"
 "value is Integer.MIN_VALUE, negating the return value won't\n"

docs/locale/ja/LC_MESSAGES/running.po

@@ -400,11 +400,11 @@ msgstr "報告されたバグインスタンスをクラス名でソートしま
 msgid ""
 "From SpotBugs 4.5.0, this option receives a file path like "
 "``-sortByClass=path/to/spotbugs.txt``. It is also supported to set "
-"multiple reports like ``-xml:spotbugs.xml -sortByClass:spotbugs.txt``."
+"multiple reports like ``-xml=spotbugs.xml -sortByClass=spotbugs.txt``."
 msgstr ""
 "SpotBugs 4.5.0以降では、このオプションはファイルパスを受け取るようになりました。"
 "``-sortByClass=path/to/spotbugs.txt`` のように使用します。複数のレポートを出力するために "
-"``-xml:spotbugs.xml -sortByClass:spotbugs.txt`` などと設定することもできます。"
+"``-xml=spotbugs.xml -sortByClass=spotbugs.txt`` などと設定することもできます。"
 
 #: ../../running.rst:177
 msgid "-include *filterFile.xml*:"
@@ -505,11 +505,11 @@ msgstr ""
 msgid ""
 "From SpotBugs 4.5.0, this option receives a file path like "
 "``-xml:withMessages=path/to/spotbugs.xml``. It is also supported to set "
-"multiple reports like ``-xml:spotbugs.xml -html:spotbugs.html``."
+"multiple reports like ``-xml=spotbugs.xml -html=spotbugs.html``."
 msgstr ""
 "SpotBugs "
 "4.5.0以降では、このオプションはファイルパスを受け取るようになりました。``-xml:withMessages=path/to/spotbugs.xml``"
-" のように使用します。複数のレポートを出力するために ``-xml:spotbugs.xml -html:spotbugs.html`` "
+" のように使用します。複数のレポートを出力するために ``-xml=spotbugs.xml -html=spotbugs.html`` "
 "と設定することもできます。"
 
 #: ../../running.rst:222
@@ -553,11 +553,11 @@ msgstr ""
 msgid ""
 "From SpotBugs 4.5.0, this option receives a file path like ``-html:fancy-"
 "hist.xsl=path/to/spotbugs.html``. It is also supported to set multiple "
-"reports like ``-xml:spotbugs.xml -html:spotbugs.html``."
+"reports like ``-xml=spotbugs.xml -html=spotbugs.html``."
 msgstr ""
 "SpotBugs 4.5.0以降では、このオプションはファイルパスを受け取るようになりました。``-html:fancy-"
 "hist.xsl=path/to/spotbugs.html`` のように使用します。複数のレポートを出力するために "
-"``-xml:spotbugs.xml -html:spotbugs.html`` などと設定することもできます。"
+"``-xml=spotbugs.xml -html=spotbugs.html`` などと設定することもできます。"
 
 #: ../../running.rst:228
 msgid "-sarif=filepath:"
@@ -575,11 +575,11 @@ msgstr ""
 msgid ""
 "From SpotBugs 4.5.0, this option receives a file path like "
 "``-sarif=path/to/spotbugs.sarif``. It is also supported to set multiple "
-"reports like ``-xml:spotbugs.xml -sarif:spotbugs.sarif``."
+"reports like ``-xml=spotbugs.xml -sarif=spotbugs.sarif``."
 msgstr ""
 "SpotBugs "
 "4.5.0以降では、このオプションはファイルパスを受け取るようになりました。``-sarif=path/to/spotbugs.sarif`` "
-"のように使用します。複数のレポートを出力するために ``-xml:spotbugs.xml -sarif:spotbugs.sarif`` "
+"のように使用します。複数のレポートを出力するために ``-xml=spotbugs.xml -sarif=spotbugs.sarif`` "
 "などと設定することもできます。"
 
 #: ../../running.rst:231

docs/locale/pt_BR/LC_MESSAGES/bugDescriptions.po

@@ -704,7 +704,7 @@ msgstr ""
 
 #: ../../generated/bugDescriptionList.inc:524
 msgid ""
-"  <p> This code negatives the return value of a compareTo or compare "
+"  <p> This code negates the return value of a compareTo or compare "
 "method.\n"
 "This is a questionable or bad programming practice, since if the return\n"
 "value is Integer.MIN_VALUE, negating the return value won't\n"

docs/locale/pt_BR/LC_MESSAGES/running.po

@@ -437,7 +437,7 @@ msgstr "Classifica as instâncias de bug relatadas por nome de classe."
 msgid ""
 "From SpotBugs 4.5.0, this option receives a file path like "
 "``-sortByClass=path/to/spotbugs.txt``. It is also supported to set "
-"multiple reports like ``-xml:spotbugs.xml -sortByClass:spotbugs.txt``."
+"multiple reports like ``-xml=spotbugs.xml -sortByClass=spotbugs.txt``."
 msgstr ""
 
 #: ../../running.rst:177
@@ -552,7 +552,7 @@ msgstr ""
 msgid ""
 "From SpotBugs 4.5.0, this option receives a file path like "
 "``-xml:withMessages=path/to/spotbugs.xml``. It is also supported to set "
-"multiple reports like ``-xml:spotbugs.xml -html:spotbugs.html``."
+"multiple reports like ``-xml=spotbugs.xml -html=spotbugs.html``."
 msgstr ""
 
 #: ../../running.rst:222
@@ -599,7 +599,7 @@ msgstr ""
 msgid ""
 "From SpotBugs 4.5.0, this option receives a file path like ``-html:fancy-"
 "hist.xsl=path/to/spotbugs.html``. It is also supported to set multiple "
-"reports like ``-xml:spotbugs.xml -html:spotbugs.html``."
+"reports like ``-xml=spotbugs.xml -html=spotbugs.html``."
 msgstr ""
 
 #: ../../running.rst:228
@@ -618,7 +618,7 @@ msgstr ""
 msgid ""
 "From SpotBugs 4.5.0, this option receives a file path like "
 "``-sarif=path/to/spotbugs.sarif``. It is also supported to set multiple "
-"reports like ``-xml:spotbugs.xml -sarif:spotbugs.sarif``."
+"reports like ``-xml=spotbugs.xml -sarif=spotbugs.sarif``."
 msgstr ""
 
 #: ../../running.rst:231

docs/requirements.txt

@@ -1,2 +1,2 @@
-sphinx_rtd_theme==0.5.2
-sphinx-intl==2.0.1
+sphinx_rtd_theme==1.2.0
+sphinx-intl==2.1.0

docs/running.rst

@@ -170,7 +170,7 @@ These options are only accepted by the Text User Interface.
   Sort reported bug instances by class name.
 
   From SpotBugs 4.5.0, this option receives a file path like ``-sortByClass=path/to/spotbugs.txt``.
-  It is also supported to set multiple reports like ``-xml:spotbugs.xml -sortByClass:spotbugs.txt``.
+  It is also supported to set multiple reports like ``-xml=spotbugs.xml -sortByClass=spotbugs.txt``.
 
 -include *filterFile.xml*:
   Only report bug instances that match the filter specified by filterFile.xml.
@@ -207,7 +207,7 @@ These options are only accepted by the Text User Interface.
   XML files generated this way are easy to transform into reports.
 
   From SpotBugs 4.5.0, this option receives a file path like ``-xml:withMessages=path/to/spotbugs.xml``.
-  It is also supported to set multiple reports like ``-xml:spotbugs.xml -html:spotbugs.html``.
+  It is also supported to set multiple reports like ``-xml=spotbugs.xml -html=spotbugs.html``.
 
 -html=filepath:
   Generate HTML output. By default, SpotBugs will use the default.xsl XSLT stylesheet to generate the HTML: you can find this file in spotbugs.jar, or in the SpotBugs source or binary distributions.
@@ -219,13 +219,13 @@ These options are only accepted by the Text User Interface.
   If you want to specify your own XSLT stylesheet to perform the transformation to HTML, specify the option as ``-html:myStylesheet.xsl``, where ``myStylesheet.xsl`` is the filename of the stylesheet you want to use.
 
   From SpotBugs 4.5.0, this option receives a file path like ``-html:fancy-hist.xsl=path/to/spotbugs.html``.
-  It is also supported to set multiple reports like ``-xml:spotbugs.xml -html:spotbugs.html``.
+  It is also supported to set multiple reports like ``-xml=spotbugs.xml -html=spotbugs.html``.
 
 -sarif=filepath:
   Produce the bug reports in `SARIF 2.1.0 <https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html>`_.
 
   From SpotBugs 4.5.0, this option receives a file path like ``-sarif=path/to/spotbugs.sarif``.
-  It is also supported to set multiple reports like ``-xml:spotbugs.xml -sarif:spotbugs.sarif``.
+  It is also supported to set multiple reports like ``-xml=spotbugs.xml -sarif=spotbugs.sarif``.
 
 -emacs=filepath:
   Produce the bug reports in Emacs format.

eclipsePlugin-junit/build.gradle

@@ -12,7 +12,7 @@ tasks.named('compileJava', JavaCompile).configure {
 dependencies {
   implementation project(':eclipsePlugin')
   testImplementation 'junit:junit:4.13.2'
-  testImplementation 'org.mockito:mockito-core:4.6.1'
+  testImplementation 'org.mockito:mockito-core:5.3.1'
 }
 
 tasks.named('jacocoTestReport', JacocoReport).configure {

eclipsePlugin-junit/src/test/java/de/tobject/findbugs/reporter/ThrottledProgressMonitorTest.java

@@ -42,7 +42,7 @@ public void testWorked() {
         verify(delegate).worked(2 + 4);
     }
 
-    private static class Clock {
+    private static final class Clock {
         private long currentTime;
 
         protected long getCurrentTime() {

eclipsePlugin-test/build.gradle

@@ -26,8 +26,8 @@ dependencies {
   }
 
   implementation project(':test-harness')
-  implementation 'org.hamcrest:hamcrest-all:1.3'
-  implementation 'org.apache.ant:ant:1.10.12'
+  implementation 'org.hamcrest:hamcrest-core:2.2'
+  implementation 'org.apache.ant:ant:1.10.13'
 }
 
 // This disables hundreds of javadoc warnings on missing tags etc, see #340