Common static analysis issues

org.openrewrite.staticanalysis.CommonStaticAnalysis

Resolve common static analysis issues (also known as SAST issues).

Recipe source

GitHub, Issue Tracker, Maven Central

• groupId: org.openrewrite.recipe

• artifactId: rewrite-static-analysis

• version: 1.5.0

This recipe is composed of more than one recipe. If you want to customize the set of recipes this is composed of, you can find and copy the GitHub source for the recipe from the link above.

Usage

This recipe has no required configuration options. It can be activated by adding a dependency on org.openrewrite.recipe:rewrite-static-analysis:1.5.0 in your build file or by running a shell command (in which case no build changes are needed):

Gradle

1. Add the following to your build.gradle file:

build.gradle

plugins {
    id("org.openrewrite.rewrite") version("6.12.0")
}

rewrite {
    activeRecipe("org.openrewrite.staticanalysis.CommonStaticAnalysis")
}

repositories {
    mavenCentral()
}

dependencies {
    rewrite("org.openrewrite.recipe:rewrite-static-analysis:1.5.0")
}

2. Run gradle rewriteRun to run the recipe.

Gradle init script

1. Create a file named init.gradle in the root of your project.

init.gradle

initscript {
    repositories {
        maven { url "https://plugins.gradle.org/m2" }
    }
    dependencies { classpath("org.openrewrite:plugin:6.12.0") }
}
rootProject {
    plugins.apply(org.openrewrite.gradle.RewritePlugin)
    dependencies {
        rewrite("org.openrewrite.recipe:rewrite-static-analysis:1.5.0")
    }
    rewrite {
        activeRecipe("org.openrewrite.staticanalysis.CommonStaticAnalysis")
    }
    afterEvaluate {
        if (repositories.isEmpty()) {
            repositories {
                mavenCentral()
            }
        }
    }
}

2. Run gradle --init-script init.gradle rewriteRun to run the recipe.

Maven POM

1. Add the following to your pom.xml file:

pom.xml

<project>
  <build>
    <plugins>
      <plugin>
        <groupId>org.openrewrite.maven</groupId>
        <artifactId>rewrite-maven-plugin</artifactId>
        <version>5.29.0</version>
        <configuration>
          <activeRecipes>
            <recipe>org.openrewrite.staticanalysis.CommonStaticAnalysis</recipe>
          </activeRecipes>
        </configuration>
        <dependencies>
          <dependency>
            <groupId>org.openrewrite.recipe</groupId>
            <artifactId>rewrite-static-analysis</artifactId>
            <version>1.5.0</version>
          </dependency>
        </dependencies>
      </plugin>
    </plugins>
  </build>
</project>

2. Run mvn rewrite:run to run the recipe.

Maven Command Line

shell

mvn -U org.openrewrite.maven:rewrite-maven-plugin:run -Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-static-analysis:RELEASE -Drewrite.activeRecipes=org.openrewrite.staticanalysis.CommonStaticAnalysis

Moderne CLI

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell

mod run . --recipe CommonStaticAnalysis

Definition

Recipe List

• Atomic Boolean, Integer, and Long equality checks compare their values

• new BigDecimal(double) should not be used

• BigDecimal rounding constants to RoundingMode enums

• Boolean checks should not be inverted

• CaseInsensitive comparisons do not alter case

• Catch clause should do more than just rethrow

• Chain StringBuilder.append() calls

• Covariant equals

• Default comes last

• Remove empty blocks

• Equals avoids null

• Explicit initialization

• Externalizable classes have no-arguments constructor

• Finalize private fields

• Fall through

• Finalize classes with private constructors

• Fix String#format and String#formatted expressions

• for loop counters incremented in update

• Use indexOf(String, int)

• indexOf() replaceable by contains()

• indexOf should not compare greater than zero

• Inline variable

• Use Collection#isEmpty() instead of comparing size()

• Simplify lambda blocks to expressions

• Method name casing

• switch statements should have at least 3 case clauses

• Modifier order

• No multiple variable declarations

• Fix missing braces

• Nested enums are not static

• Change StringBuilder and StringBuffer character constructor argument to String

• No double brace initialization

• Use Collections#emptyList(), emptyMap(), and emptySet()

• Use comparison rather than equality checks in for conditions

• Remove finalize() method

• No primitive wrappers for #toString() or #compareTo(..)

• Jump statements should not be redundant

• Unnecessary String#toString()

• Unnecessary String#valueOf(..)

• finalize() calls super

• Use primitive wrapper valueOf method

• Redundant file creation

• Remove extra semicolons

• Reformat local variable names to camelCase

• Rename methods named hashcode, equal, or tostring

• Reformat private field names to camelCase

• Use method references in lambda

• Replace StringBuilder.append() with String

• Simplify boolean expression

• Simplify boolean return

• Static methods not final

• Use String.equals() on String literals

• Unnecessary close in try-with-resources

• Unnecessary explicit type arguments

• Remove unnecessary parentheses

• Remove Nullable and CheckForNull annotations from primitives

• Upper case literal suffixes

• Use diamond operator

• No C-style array declarations

• Prefer while over for loops

• Write octal values as decimal

• Structural equality tests should use == or !=

• it shouldn't be used as a lambda parameter name

• Replace Char#toInt() with Char#code

Yaml Recipe List

---
type: specs.openrewrite.org/v1beta/recipe
name: org.openrewrite.staticanalysis.CommonStaticAnalysis
displayName: Common static analysis issues
description: Resolve common static analysis issues (also known as SAST issues).
recipeList:
  - org.openrewrite.staticanalysis.AtomicPrimitiveEqualsUsesGet
  - org.openrewrite.staticanalysis.BigDecimalDoubleConstructorRecipe
  - org.openrewrite.staticanalysis.BigDecimalRoundingConstantsToEnums
  - org.openrewrite.staticanalysis.BooleanChecksNotInverted
  - org.openrewrite.staticanalysis.CaseInsensitiveComparisonsDoNotChangeCase
  - org.openrewrite.staticanalysis.CatchClauseOnlyRethrows
  - org.openrewrite.staticanalysis.ChainStringBuilderAppendCalls
  - org.openrewrite.staticanalysis.CovariantEquals
  - org.openrewrite.staticanalysis.DefaultComesLast
  - org.openrewrite.staticanalysis.EmptyBlock
  - org.openrewrite.staticanalysis.EqualsAvoidsNull
  - org.openrewrite.staticanalysis.ExplicitInitialization
  - org.openrewrite.staticanalysis.ExternalizableHasNoArgsConstructor
  - org.openrewrite.staticanalysis.FinalizePrivateFields
  - org.openrewrite.staticanalysis.FallThrough
  - org.openrewrite.staticanalysis.FinalClass
  - org.openrewrite.staticanalysis.FixStringFormatExpressions
  - org.openrewrite.staticanalysis.ForLoopIncrementInUpdate
  - org.openrewrite.staticanalysis.IndexOfChecksShouldUseAStartPosition
  - org.openrewrite.staticanalysis.IndexOfReplaceableByContains
  - org.openrewrite.staticanalysis.IndexOfShouldNotCompareGreaterThanZero
  - org.openrewrite.staticanalysis.InlineVariable
  - org.openrewrite.staticanalysis.IsEmptyCallOnCollections
  - org.openrewrite.staticanalysis.LambdaBlockToExpression
  - org.openrewrite.staticanalysis.MethodNameCasing:
  - org.openrewrite.staticanalysis.MinimumSwitchCases
  - org.openrewrite.staticanalysis.ModifierOrder
  - org.openrewrite.staticanalysis.MultipleVariableDeclarations
  - org.openrewrite.staticanalysis.NeedBraces
  - org.openrewrite.staticanalysis.NestedEnumsAreNotStatic
  - org.openrewrite.staticanalysis.NewStringBuilderBufferWithCharArgument
  - org.openrewrite.staticanalysis.NoDoubleBraceInitialization
  - org.openrewrite.staticanalysis.NoEmptyCollectionWithRawType
  - org.openrewrite.staticanalysis.NoEqualityInForCondition
  - org.openrewrite.staticanalysis.NoFinalizer
  - org.openrewrite.staticanalysis.NoPrimitiveWrappersForToStringOrCompareTo
  - org.openrewrite.staticanalysis.NoRedundantJumpStatements
  - org.openrewrite.staticanalysis.NoToStringOnStringType
  - org.openrewrite.staticanalysis.NoValueOfOnStringType
  - org.openrewrite.staticanalysis.ObjectFinalizeCallsSuper
  - org.openrewrite.staticanalysis.PrimitiveWrapperClassConstructorToValueOf
  - org.openrewrite.staticanalysis.RedundantFileCreation
  - org.openrewrite.staticanalysis.RemoveExtraSemicolons
  - org.openrewrite.staticanalysis.RenameLocalVariablesToCamelCase
  - org.openrewrite.staticanalysis.RenameMethodsNamedHashcodeEqualOrTostring
  - org.openrewrite.staticanalysis.RenamePrivateFieldsToCamelCase
  - org.openrewrite.staticanalysis.ReplaceLambdaWithMethodReference
  - org.openrewrite.staticanalysis.ReplaceStringBuilderWithString
  - org.openrewrite.staticanalysis.SimplifyBooleanExpression
  - org.openrewrite.staticanalysis.SimplifyBooleanReturn
  - org.openrewrite.staticanalysis.StaticMethodNotFinal
  - org.openrewrite.staticanalysis.StringLiteralEquality
  - org.openrewrite.staticanalysis.UnnecessaryCloseInTryWithResources
  - org.openrewrite.staticanalysis.UnnecessaryExplicitTypeArguments
  - org.openrewrite.staticanalysis.UnnecessaryParentheses
  - org.openrewrite.staticanalysis.UnnecessaryPrimitiveAnnotations
  - org.openrewrite.staticanalysis.UpperCaseLiteralSuffixes
  - org.openrewrite.staticanalysis.UseDiamondOperator
  - org.openrewrite.staticanalysis.UseJavaStyleArrayDeclarations
  - org.openrewrite.staticanalysis.WhileInsteadOfFor
  - org.openrewrite.staticanalysis.WriteOctalValuesAsDecimal
  - org.openrewrite.kotlin.cleanup.EqualsMethodUsage
  - org.openrewrite.kotlin.cleanup.ImplicitParameterInLambda
  - org.openrewrite.kotlin.cleanup.ReplaceCharToIntWithCode

See how this recipe works across multiple open-source repositories

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Contributors

Jonathan Schneider, Knut Wannheden, Patrick Way, Kun Li, Patrick, Aaron Gershman, Tracey Yoshima, Sam Snyder, Jonathan Leitschuh, Tim te Beek, Tim te Beek, SMIT MALKAN, Michel Gonzalez, traceyyoshima, Guliver, Kun Li, Joan Viladrosa, Tyler Van Gorder, Peter Streef, Josh Soref, Nick McKinney, Jorge Otero, Michael Keppler, timo-abele, Grzegorz Olędzki, Knut Wannheden, Peter Streef, Jonathan Schnéider, Greg Adams, Mike Sol, pstreef, Scott Jungling, Martin Panzer, Mike Solomon, xshen053