Problems with FindBugs exclude filter

Question

I am in the process of evaluating FindBugs and am trying to make use of the excludeFilter so that the tool does not process the test packages or the generated ejb stubs.

I have tried the following:

<FindBugsFilter>
<!-- Match any test packages -->
<Match>
    <Package name="~.*\.test"/>
</Match>
<Match>
    <Or>
        <Class name="~.*\.^_*"/>
        <Class name="~.*EJS*"/>
    </Or>
    <Bug pattern="MALICIOUS_CODE"/>
</Match>

The generated EJB's are still being looked at. Can someone provide some better direction on this.

I want to exclude out all classes that start with "_"

Example:

com/mycompany/business/admin/ejb/_AdminRemoteHome_Stub.java

com/mycompany/business/admin/ejb/_EJSRemoteStatelessAdminHome_054d51b9_Tie.java

Updated filter file.

I change the filter file to the following structure using the suggested regx changes and now things are working as expected:

<FindBugsFilter>
<!-- Match any test packages -->
<Match>
    <Package name="~.*\.test"/>
</Match>
<Match>
    <Class name="~.*\._.*"/>
</Match>
<Match>
    <Class name="~.*?EJS.*"/>       
</Match>

Looks like I need to go back and brush up on my regx.

Soulsearching

Are EJS classes still showing up? Do you have only the problem for '_' classes now? – Skipper

Answer 1

Regarding FindBugFilter,

(just to be sure) are you sure you are considering the compiled class files directories, and not the sourcePath? (as mentioned in this SO answer).

From the Java element name matching section:

If the name attribute of Class, Method or Field starts with the ~ character the rest of attribute content is interpreted as a Java regular expression that is matched against the names of the Java element in question.

Would the following regex be more accurate?

    <Class name="~.*\._.*"/>
    <Class name="~.*?EJS.*"/>

• ".*\._.*" instead of ".*\.^_*" because the anchor is supposed to match at the start of the string the regex pattern is applied to.

• ".*?EJS.*" instead of ".*EJS*" because the ? quantifier makes the matching lazy, avoiding to 'eat' EJS. (Plus "S*" means "0 or n S", which does not help here)

Skipper

I just used your suggestion but the classes are still showing up in the report. – Soulsearching

Here is what the report is generating: com/mycompany/business/admin/ejb/_AdminRemoteHome_Stub.java 2 Line 33 MALICIOUS_CODE May expose internal representation by returning reference to mutable object – Soulsearching

I have the same problem, it doesnt even exclude: <Match> <Package name="~.*"/ > <Package name=".*"/ > </Match> – Tommy

Answer 2

My findbugs exclude file was not working as above. I'm using the findbugs-maven-plugin v3.0.0. To resolve the issue I ran a build which generated findbugsXml.xml, then issued:

mvn findbugs:gui

This starts the User Interface to findbugs. I then loaded the findbugsXml.xml file, navigated to the warnings I desired excluded, excluded them and then saved the exclusions to findbugs_exclude.xml. I added this to the maven plugin as

<excludeFilterFile>findbugs_exclude.xml</excludeFilterFile>

The generated file works and the exclusions are truly omitted from the findbugs report.

Another great tip I found for the maven plugin was to add:

<omitVisitors>UnreadFields</omitVisitors>

Made

This actually doesn't work at all. I desire to have all current warnings excluded, so I selected the root of the warnings, saved the exclusions to findbugs_exclude.xml, and all I got an empty file, only containing <FindBugsFilter></FindBugsFilter>. – Kamacite

the <excludeFilterFile> element means "Don't use this filter file". You need to wrap it in the <includeFilterFile> element. – Norine

Answer 3

It is helpful to mention that if a class is supposed to be excluded, be careful with its inner classes. It took me hours to find out that instead of

<Match>
    <Class name="com.some.Proto" /> <!--or com.some.Proto$.*-->
</Match>

I should use the following config with its inner classes listed one by one

<Match>
    <Or>
    <Class name="com.some.Proto$Event" />
    <Class name="com.some.Proto$Msg" />
    <Class name="com.some.Proto$Query" />
    </Or>
</Match>

And so far I haven't found out how to exclude a class and all its subclass (not a clue in filter), a simple regex like com.some.Proto$.* just does not work. And I also noticed that $ in regex means the end of line, while findbugs read it as a text character I think, otherwise it should have been com.some.Proto\$Query. Besides, a valuable regex tester helped me on regex by explaining every character in it.

Tectonics