在Gradle构建中禁用findbugs检查的错误类别

Question

我一直在eclipse中使用Findbugs插件,现在想将功能移到我的Gradle构建脚本中,以便在检测到任何严重错误时构建将失败.我想禁用以下错误类别:

1. 试验
2. 安全
3. 国际化
4. 恶意代码

以上是Eclipse插件的默认设置.但是在Gradle中,查看文档我只能找到一种禁用单个错误检查的方法.然而,这是不可行的,查看源代码,其中有近100个要经过并单独启用/禁用.

是否有更简单的方法来禁用上述类别,以便Gradle调用的Findbugs与Eclipse插件默认配置相同？

编辑:到目前为止,我们已经发现"excludeFilter"选项可用于指定包含应排除的错误检查程序的XML文件.然后可以在此文件中指定要排除的类别,如下所示:

<FindBugsFilter>
        <Match>
                <Bug category="EXPERIMENTAL"/>
        </Match> 
</FindBugsFilter>

可以通过在排除文件中指定category属性来禁用错误类别:

• 国际化:I18N
• 恶意代码:MALICIOUS_CODE
• 实验:实验
• 正确性:正确性
• 表现:表现
• 代码风格:STYLE
• 不好的做法:BAD_PRACTICE

然而,这些类别属性似乎没有记录,所以我不确定我是否找到了所有这些属性.当我找到更多时,将编辑此列表.

Answer 1

你是对的,FindBug类别列表似乎没有完全记录.通过https://sourceforge.net/projects/findbugs/files/findbugs/3.0.1/搜索源包,您可以在默认messages.xml中找到BugCategory定义.

我提取了信息并创建了一个匹配findbugs-3.0.1\etc\messages.xml中找到的所有类别的过滤器:

<FindBugsFilter>
    <!-- Probable bug - an apparent coding mistake resulting in code that was 
        probably not what the developer intended. We strive for a low false positive 
        rate. -->
    <Match>
        <Bug category="CORRECTNESS" />
    </Match>

    <!-- Bogus random noise: intended to be useful as a control in data mining 
        experiments, not in finding actual bugs in software. -->
    <Match>
        <Bug category="NOISE" />
    </Match>

    <!-- A use of untrusted input in a way that could create a remotely exploitable 
        security vulnerability. -->
    <Match>
        <Bug category="SECURITY" />
    </Match>

    <!-- Violations of recommended and essential coding practice. Examples include 
        hash code and equals problems, cloneable idiom, dropped exceptions, Serializable 
        problems, and misuse of finalize. We strive to make this analysis accurate, 
        although some groups may not care about some of the bad practices. -->
    <Match>
        <Bug category="BAD_PRACTICE" />
    </Match>

    <!-- code that is confusing, anomalous, or written in a way that leads itself 
        to errors. Examples include dead local stores, switch fall through, unconfirmed 
        casts, and redundant null check of value known to be null. More false positives 
        accepted. In previous versions of FindBugs, this category was known as Style. -->
    <Match>
        <Bug category="STYLE" />
    </Match>

    <!-- code that is not necessarily incorrect but may be inefficient -->
    <Match>
        <Bug category="PERFORMANCE" />
    </Match>

    <!-- code that is vulnerable to attacks from untrusted code -->
    <Match>
        <Bug category="MALICIOUS_CODE" />
    </Match>

    <!-- code flaws having to do with threads, locks, and volatiles -->
    <Match>
        <Bug category="MT_CORRECTNESS" />
    </Match>

    <!-- code flaws having to do with internationalization and locale -->
    <Match>
        <Bug category="I18N" />
    </Match>

    <!-- Experimental and not fully vetted bug patterns -->
    <Match>
        <Bug category="EXPERIMENTAL" />
    </Match>

</FindBugsFilter>