Common static analysis issues
org.openrewrite.staticanalysis.CommonStaticAnalysis
Resolve common static analysis issues (also known as SAST issues).
Recipe source
GitHub, Issue Tracker, Maven Central
This recipe is composed of more than one recipe. If you want to customize the set of recipes this is composed of, you can find and copy the GitHub source for the recipe from the link above.
License
This recipe is available under the Moderne Source Available License.
Definition
- Recipe List
- Yaml Recipe List
- Atomic Boolean, Integer, and Long equality checks compare their values
new BigDecimal(double)
should not be usedBigDecimal
rounding constants toRoundingMode
enums- Boolean checks should not be inverted
- CaseInsensitive comparisons do not alter case
- Catch clause should do more than just rethrow
- Chain
StringBuilder.append()
calls - Covariant equals
- Default comes last
- Remove empty blocks
- Equals avoids null
- Explicit initialization
Externalizable
classes have no-arguments constructor- Finalize private fields
- Fall through
- Finalize classes with private constructors
- Fix
String#format
andString#formatted
expressions for
loop counters incremented in update- Use
indexOf(String, int)
indexOf()
replaceable bycontains()
indexOf
should not compare greater than zero- Inline variable
- Use
Collection#isEmpty()
instead of comparingsize()
- Simplify lambda blocks to expressions
- Standardize method name casing
switch
statements should have at least 3case
clauses- Modifier order
- No multiple variable declarations
- Fix missing braces
- Nested enums are not static
- Change
StringBuilder
andStringBuffer
character constructor argument toString
- No double brace initialization
- Use
Collections#emptyList()
,emptyMap()
, andemptySet()
- Use comparison rather than equality checks in for conditions
- Remove
finalize()
method - No primitive wrappers for #toString() or #compareTo(..)
- Jump statements should not be redundant
- Unnecessary
String#toString
- Unnecessary
String#valueOf(..)
finalize()
calls super- Use primitive wrapper
valueOf
method - Redundant file creation
- Remove extra semicolons
- Reformat local variable names to camelCase
- Rename methods named
hashcode
,equal
, ortostring
- Reformat private field names to camelCase
- Replace
A.class.isInstance(a)
witha instanceof A
- Use method references in lambda
- Replace
StringBuilder#append
withString
- Simplify boolean expression
- Simplify boolean return
- Static methods need not be final
- Use
String.equals()
onString
literals - Unnecessary close in try-with-resources
- Unnecessary explicit type arguments
- Remove unnecessary parentheses
- Remove
@Nullable
and@CheckForNull
annotations from primitives - Unnecessary
return
as last statement in void method - Upper case literal suffixes
- Use the diamond operator
- No C-style array declarations
- Prefer
while
overfor
loops - Write octal values as decimal
- Structural equality tests should use
==
or!=
it
shouldn't be used as a lambda parameter name- Replace
Char#toInt()
withChar#code
---
type: specs.openrewrite.org/v1beta/recipe
name: org.openrewrite.staticanalysis.CommonStaticAnalysis
displayName: Common static analysis issues
description: Resolve common static analysis issues (also known as SAST issues).
recipeList:
- org.openrewrite.staticanalysis.AtomicPrimitiveEqualsUsesGet
- org.openrewrite.staticanalysis.BigDecimalDoubleConstructorRecipe
- org.openrewrite.staticanalysis.BigDecimalRoundingConstantsToEnums
- org.openrewrite.staticanalysis.BooleanChecksNotInverted
- org.openrewrite.staticanalysis.CaseInsensitiveComparisonsDoNotChangeCase
- org.openrewrite.staticanalysis.CatchClauseOnlyRethrows
- org.openrewrite.staticanalysis.ChainStringBuilderAppendCalls
- org.openrewrite.staticanalysis.CovariantEquals
- org.openrewrite.staticanalysis.DefaultComesLast
- org.openrewrite.staticanalysis.EmptyBlock
- org.openrewrite.staticanalysis.EqualsAvoidsNull
- org.openrewrite.staticanalysis.ExplicitInitialization
- org.openrewrite.staticanalysis.ExternalizableHasNoArgsConstructor
- org.openrewrite.staticanalysis.FinalizePrivateFields
- org.openrewrite.staticanalysis.FallThrough
- org.openrewrite.staticanalysis.FinalClass
- org.openrewrite.staticanalysis.FixStringFormatExpressions
- org.openrewrite.staticanalysis.ForLoopIncrementInUpdate
- org.openrewrite.staticanalysis.IndexOfChecksShouldUseAStartPosition
- org.openrewrite.staticanalysis.IndexOfReplaceableByContains
- org.openrewrite.staticanalysis.IndexOfShouldNotCompareGreaterThanZero
- org.openrewrite.staticanalysis.InlineVariable
- org.openrewrite.staticanalysis.IsEmptyCallOnCollections
- org.openrewrite.staticanalysis.LambdaBlockToExpression
- org.openrewrite.staticanalysis.MethodNameCasing
- org.openrewrite.staticanalysis.MinimumSwitchCases
- org.openrewrite.staticanalysis.ModifierOrder
- org.openrewrite.staticanalysis.MultipleVariableDeclarations
- org.openrewrite.staticanalysis.NeedBraces
- org.openrewrite.staticanalysis.NestedEnumsAreNotStatic
- org.openrewrite.staticanalysis.NewStringBuilderBufferWithCharArgument
- org.openrewrite.staticanalysis.NoDoubleBraceInitialization
- org.openrewrite.staticanalysis.NoEmptyCollectionWithRawType
- org.openrewrite.staticanalysis.NoEqualityInForCondition
- org.openrewrite.staticanalysis.NoFinalizer
- org.openrewrite.staticanalysis.NoPrimitiveWrappersForToStringOrCompareTo
- org.openrewrite.staticanalysis.NoRedundantJumpStatements
- org.openrewrite.staticanalysis.NoToStringOnStringType
- org.openrewrite.staticanalysis.NoValueOfOnStringType
- org.openrewrite.staticanalysis.ObjectFinalizeCallsSuper
- org.openrewrite.staticanalysis.PrimitiveWrapperClassConstructorToValueOf
- org.openrewrite.staticanalysis.RedundantFileCreation
- org.openrewrite.staticanalysis.RemoveExtraSemicolons
- org.openrewrite.staticanalysis.RenameLocalVariablesToCamelCase
- org.openrewrite.staticanalysis.RenameMethodsNamedHashcodeEqualOrToString
- org.openrewrite.staticanalysis.RenamePrivateFieldsToCamelCase
- org.openrewrite.staticanalysis.ReplaceClassIsInstanceWithInstanceof
- org.openrewrite.staticanalysis.ReplaceLambdaWithMethodReference
- org.openrewrite.staticanalysis.ReplaceStringBuilderWithString
- org.openrewrite.staticanalysis.SimplifyBooleanExpression
- org.openrewrite.staticanalysis.SimplifyBooleanReturn
- org.openrewrite.staticanalysis.StaticMethodNotFinal
- org.openrewrite.staticanalysis.StringLiteralEquality
- org.openrewrite.staticanalysis.UnnecessaryCloseInTryWithResources
- org.openrewrite.staticanalysis.UnnecessaryExplicitTypeArguments
- org.openrewrite.staticanalysis.UnnecessaryParentheses
- org.openrewrite.staticanalysis.UnnecessaryPrimitiveAnnotations
- org.openrewrite.staticanalysis.UnnecessaryReturnAsLastStatement
- org.openrewrite.staticanalysis.UpperCaseLiteralSuffixes
- org.openrewrite.staticanalysis.UseDiamondOperator
- org.openrewrite.staticanalysis.UseJavaStyleArrayDeclarations
- org.openrewrite.staticanalysis.WhileInsteadOfFor
- org.openrewrite.staticanalysis.WriteOctalValuesAsDecimal
- org.openrewrite.kotlin.cleanup.EqualsMethodUsage
- org.openrewrite.kotlin.cleanup.ImplicitParameterInLambda
- org.openrewrite.kotlin.cleanup.ReplaceCharToIntWithCode
Usage
This recipe has no required configuration options. It can be activated by adding a dependency on org.openrewrite.recipe:rewrite-static-analysis
in your build file or by running a shell command (in which case no build changes are needed):
- Gradle
- Gradle init script
- Maven POM
- Maven Command Line
- Moderne CLI
- Add the following to your
build.gradle
file:
plugins {
id("org.openrewrite.rewrite") version("6.28.3")
}
rewrite {
activeRecipe("org.openrewrite.staticanalysis.CommonStaticAnalysis")
setExportDatatables(true)
}
repositories {
mavenCentral()
}
dependencies {
rewrite("org.openrewrite.recipe:rewrite-static-analysis:1.22.0")
}
- Run
gradle rewriteRun
to run the recipe.
- Create a file named
init.gradle
in the root of your project.
initscript {
repositories {
maven { url "https://plugins.gradle.org/m2" }
}
dependencies { classpath("org.openrewrite:plugin:6.28.3") }
}
rootProject {
plugins.apply(org.openrewrite.gradle.RewritePlugin)
dependencies {
rewrite("org.openrewrite.recipe:rewrite-static-analysis:1.22.0")
}
rewrite {
activeRecipe("org.openrewrite.staticanalysis.CommonStaticAnalysis")
setExportDatatables(true)
}
afterEvaluate {
if (repositories.isEmpty()) {
repositories {
mavenCentral()
}
}
}
}
- Run the recipe.
gradle --init-script init.gradle rewriteRun
- Add the following to your
pom.xml
file:
<project>
<build>
<plugins>
<plugin>
<groupId>org.openrewrite.maven</groupId>
<artifactId>rewrite-maven-plugin</artifactId>
<version>5.47.0</version>
<configuration>
<exportDatatables>true</exportDatatables>
<activeRecipes>
<recipe>org.openrewrite.staticanalysis.CommonStaticAnalysis</recipe>
</activeRecipes>
</configuration>
<dependencies>
<dependency>
<groupId>org.openrewrite.recipe</groupId>
<artifactId>rewrite-static-analysis</artifactId>
<version>1.22.0</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</build>
</project>
- Run
mvn rewrite:run
to run the recipe.
You will need to have Maven installed on your machine before you can run the following command.
mvn -U org.openrewrite.maven:rewrite-maven-plugin:run -Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-static-analysis:RELEASE -Drewrite.activeRecipes=org.openrewrite.staticanalysis.CommonStaticAnalysis -Drewrite.exportDatatables=true
You will need to have configured the Moderne CLI on your machine before you can run the following command.
mod run . --recipe CommonStaticAnalysis
If the recipe is not available locally, then you can install it using:
mod config recipes jar install org.openrewrite.recipe:rewrite-static-analysis:1.22.0
See how this recipe works across multiple open-source repositories
Run this recipe on OSS repos at scale with the Moderne SaaS.
The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.
Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.
Data Tables
Source files that had results
org.openrewrite.table.SourcesFileResults
Source files that were modified by the recipe run.
Column Name | Description |
---|---|
Source path before the run | The source path of the file before the run. null when a source file was created during the run. |
Source path after the run | A recipe may modify the source path. This is the path after the run. null when a source file was deleted during the run. |
Parent of the recipe that made changes | In a hierarchical recipe, the parent of the recipe that made a change. Empty if this is the root of a hierarchy or if the recipe is not hierarchical at all. |
Recipe that made changes | The specific recipe that made a change. |
Estimated time saving | An estimated effort that a developer to fix manually instead of using this recipe, in unit of seconds. |
Cycle | The recipe cycle in which the change was made. |
Source files that errored on a recipe
org.openrewrite.table.SourcesFileErrors
The details of all errors produced by a recipe run.
Column Name | Description |
---|---|
Source path | The file that failed to parse. |
Recipe that made changes | The specific recipe that made a change. |
Stack trace | The stack trace of the failure. |
Recipe performance
org.openrewrite.table.RecipeRunStats
Statistics used in analyzing the performance of recipes.
Column Name | Description |
---|---|
The recipe | The recipe whose stats are being measured both individually and cumulatively. |
Source file count | The number of source files the recipe ran over. |
Source file changed count | The number of source files which were changed in the recipe run. Includes files created, deleted, and edited. |
Cumulative scanning time | The total time spent across the scanning phase of this recipe. |
99th percentile scanning time | 99 out of 100 scans completed in this amount of time. |
Max scanning time | The max time scanning any one source file. |
Cumulative edit time | The total time spent across the editing phase of this recipe. |
99th percentile edit time | 99 out of 100 edits completed in this amount of time. |
Max edit time | The max time editing any one source file. |
Contributors
Jonathan Schneider, Knut Wannheden, Patrick Way, Kun Li, Jacob van Lingen, Patrick, Aaron Gershman, Tracey Yoshima, Sam Snyder, Jonathan Schnéider, Tim te Beek, Jonathan Leitschuh, Tim te Beek, SMIT MALKAN, Aaron Gershman, Greg Oledzki, Yurii, traceyyoshima, Guliver, Kun Li, Joan Viladrosa, Tyler Van Gorder, Peter Streef, Josh Soref, Niels de Bruin, Jorge Otero, Laurens Westerlaken, Michael Keppler, Grzegorz Olędzki, Knut Wannheden, timo-abele, Nick McKinney, punkratz312, Peter Streef, Greg Adams, Michel Gonzalez, Mike Sol, pstreef, Scott Jungling, Martin Panzer, Mike Solomon, xshen053