Skip to main content

Common static analysis issue remediation

In this guide we'll look at using OpenRewrite to perform an automated remediation for many issues identified by common static analysis tools.

Source available recipe module

This guide uses org.openrewrite.recipe:rewrite-static-analysis, a Moderne source-available recipe module. Compiled binaries are only available to Moderne customers, hosted at the Code Genome Project. For non-commercial use you can compile and publish the recipe module locally to use the recipes.

Example configuration​

The Common Static Analysis Recipe consists of more than 50 types of issues and can be applied by including OpenRewrite's plugin to your project and configuring the recipe:

This recipe has no required configuration options. It can be activated by adding a dependency on `org.openrewrite.recipe:rewrite-static-analysis` in your build file or by running a shell command (in which case no build changes are needed):

OpenRewrite artifacts are distributed through the Code Genome Project repository (https://artifacts.codegenomeproject.org/maven), which requires authentication. Sign in to the Code Genome Project to create a download token, then in the snippets below replace USERNAME with the email or username you signed in with and TOKEN with that token. See the quickstart guide for details.

  1. Add the following to your build.gradle file:
    build.gradle
    plugins {
        id("org.openrewrite.rewrite") version("latest.release")
    }

    rewrite {
        activeRecipe("org.openrewrite.staticanalysis.CommonStaticAnalysis")
    }

    repositories {
        mavenCentral()
        maven {
            url = "https://artifacts.codegenomeproject.org/maven"
            credentials {
                username = "USERNAME"
                password = "TOKEN"
            }
        }
    }

    dependencies {
        rewrite("org.openrewrite.recipe:rewrite-static-analysis:2.41.1")
    }
  2. Run gradle rewriteRun to run the recipe.

At this point, you're ready to fix common static analysis issues by running mvn rewrite:run or gradlew rewriteRun.

Before and After​

For the full list of changes this recipe will make, see its reference page.

Use explicit types on lambda arguments​

queue.findAll().forEach(msg -> {
    WebSocketMessageBody toSend = conv.fromMap(msg.getMessage(), WebSocketMessageBody.class);
    session.sendSync(toSend);
});

No Double Brace Initialization​

class Menu {
    static final List<String> menuItems = Arrays.asList("rice", "beans");
    
    void newOrder(String main, String desert) {
        List<String> menuItems = new ArrayList<>() {
            {
                add(main);
                add(desert);
            }
        };
        ...
    }
}

Fields in a Serializable class should either be transient or serializable​

public class MessageExtBatch implements Serializable {
    private ByteBuffer encodedBuff;
    ...
}

Known Limitations​

We don't have OpenRewrite recipes implemented for all publicly available policies. If you find a violation you'd like automated, visit the rewrite repository and file an issue (or help out the community by contributing code yourself).

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.