Static Analysis

One method from Project Pulse

public Result addActivityComment(...) {
    String comment = commentMap.get("comment");
    Activity updatedActivity = this.activityService.addActivityComment(activityId, comment);
    ActivityDto updatedActivityDto = this.activityToActivityDtoConverter.convert(updatedActivity);
    return new Result(true, StatusCode.SUCCESS, "Add comment successfully", null);
}

You've seen one already

So why doesn't everyone run them?

• They add no feature
• An afternoon to set up
• First run: hundreds of warnings, most on code that works

Developers give up on them over the noise. Johnson et al., ICSE 2013

goto fail

if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
    goto fail;
    goto fail;
if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)
    goto fail;

CVE-2014-1266, iOS and macOS, February 2014

Project Pulse shipped type errors

• vue-tsc: in Project Pulse since its first commit, October 2024
• Fall 2026: 18 type errors on every deploy
• The deploy ran build-only, which skips the checker

Fail fast

• Static analysis: seconds, and the program never runs
• Tests: minutes
• A reviewer: an hour

Three checks, three kinds of problem

Why not just ask your coding agent?

Why every analyzer guesses

• Can this line ever run? Undecidable: the halting problem reduces to it
• Rice's theorem: every nontrivial question about what a program does is undecidable
• So an analyzer that always finishes must approximate

Two ways to be wrong

What's a linter?

A static analyzer that checks code against a catalog of rules, and reports each match by rule, file, and line

• Frontend: ESLint
• Backend: PMD (source), SpotBugs (bytecode)

Read by rule, not by file

EI_EXPOSE_REP: sharing a mutable list

public List<Rating> getRatings() {
    return ratings;            // REP: hands out its own list
}

public void setRatings(List<Rating> ratings) {
    this.ratings = ratings;    // REP2: keeps the caller's list
    ...
    calculateTotalScore();
}

CT_CONSTRUCTOR_THROW: a half-built object

public class Account {
    private final long balance;

    public Account(long balance) {
        if (balance < 0) throw new IllegalArgumentException();
        this.balance = balance;
    }
}

PMD, read the same way

Braces: goto fail, waiting

if (!this.enabled) return; // Reminders are disabled

toLowerCase and the Turkish i

"%" + providedFirstName.toLowerCase() + "%"

• In Turkish, uppercase I lowercases to a dotless ı
• A search for "Ivan" becomes "ıvan"; the database says "ivan"
• No match. toLowerCase(Locale.ROOT) fixes it

Two decisions, yours to make

public Activity() {
}

LOGGER.error("Could not send ... {} in section {}",
        student.getEmail(), section.getSectionName(), e);

A private method nobody calls

private <T> void updateCollection(Set<T> oldCollection, Set<T> newCollection) {
    oldCollection.clear();
    ...
}

• UseCaseService.updateCollection: private, and no caller anywhere
• Dead code? Delete it
• Or a call someone forgot? That is a bug

Style, in one slide

Two tools, one overlap

.anyMatch(a -> a.getAuthority().equals("ROLE_instructor"));

PMD: put the literal first. SpotBugs: getAuthority() may be null. Two rules, one worry: when both point at a line, look.

Three verdicts

Real, but the fix needs a decision

@PatchMapping("/{activityId}/comments")
public Result addActivityComment(...) {
    String comment = commentMap.get("comment");
    Activity updatedActivity = this.activityService.addActivityComment(activityId, comment);
    ActivityDto updatedActivityDto = this.activityToActivityDtoConverter.convert(updatedActivity);
    return new Result(true, StatusCode.SUCCESS, "Add comment successfully", null);
}

True by contract, false in context

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
boolean hasInstructorRole = authentication.getAuthorities().stream() ...

Spring Security 7: @Nullable Authentication getAuthentication();

Deliberate, and the rule can't know

public void transferTeam(Team team, Section from, Section to) {
    if (team.getSection() != from) {
        throw new IllegalStateException("Team is not in the expected old section.");
    }

Same rule, different verdict

try {
  const result = await searchRequirementArtifacts(...)
  glossaryTerms.value = result.data.content
} catch {
}

The Axios interceptor already showed the error.

Fix the configuration, not the code

• 117 of ESLint's 130 problems: no-undef on cy, it, describe
• The Cypress tests are fine; the linter was never told they are Cypress
• One override in the ESLint configuration: 130 problems become 13

True, but not worth it

• PMD's LocalVariableCouldBeFinal: right about every local it flags
• Adding final everywhere changes no behavior if nobody reassigns locals
• PMD's own quickstart ruleset ships it commented out

Suppress with a reason

@SuppressFBWarnings(value = "NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE",
    justification = "Only called on authenticated routes")

// eslint-disable-next-line no-empty -- error already shown by the interceptor

Make it a gate: where the checks run

Check in CI, fix on your machine

• Locally: eslint --fix, prettier --write
• In CI: eslint, prettier --check, npm run type-check
• Deploy with the checks too: build, never build-only

Red has to block

• A failing check stops a merge only if main requires it
• GitHub: a ruleset (or branch protection) lists the required status checks
• Without it, the merge button stays enabled

Baseline, then ratchet

• Record what exists today as a baseline, untriaged
• Fail the build only on findings outside it
• Fix or suppress an old one, delete its entry
• Never add to the baseline. It only shrinks

Project Pulse #104: the gate in pom.xml

<plugin>
  <groupId>com.github.spotbugs</groupId>
  <artifactId>spotbugs-maven-plugin</artifactId>
  <version>4.10.5.0</version>
  <configuration>
    <excludeFilterFile>${project.basedir}/config/spotbugs-exclude.xml,${project.basedir}/config/spotbugs-baseline.xml</excludeFilterFile>
  </configuration>
  <executions>
    <execution><goals><goal>check</goal></goals></execution>
  </executions>
</plugin>
<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-pmd-plugin</artifactId>
  <version>3.28.0</version>
  <configuration>
    <rulesets><ruleset>${project.basedir}/config/pmd-ruleset.xml</ruleset></rulesets>
    <excludeFromFailureFile>${project.basedir}/config/pmd-baseline.properties</excludeFromFailureFile>
    <printFailingErrors>true</printFailingErrors>
  </configuration>
  <executions>
    <execution><goals><goal>check</goal></goals></execution>
  </executions>
</plugin>

Baselines: 237 SpotBugs matches, 130 PMD findings in 68 classes. Frontend checks report only, for now; Actions pinned to SHAs.

Know your baseline's grain

Upgrade, and format once

• ESLint 8: end of life October 2024. An outdated analyzer is a finding too
• Upgrade an analyzer in its own pull request; compare counts by rule
• Upgrading PMD renamed a rule: 12 baselined findings came back as new
• Format the whole codebase in one commit, alone, early
• List that commit in .git-blame-ignore-revs, then gate prettier --check

Your project: gate first

• Turn the gate on before the first feature
• Triage the handful of findings a skeleton has
• From then on, every finding is new, and fails

Write it down where it lives

A convention no tool ships

@ExceptionHandler(Exception.class)
@ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR)
Result handleOtherException(Exception ex) {
    return new Result(false, StatusCode.INTERNAL_SERVER_ERROR,
        "A server internal error occurs.", ex.getMessage());
}

The rule: a query over the syntax tree

//MethodDeclaration
  [ModifierList/Annotation[@SimpleName = 'ExceptionHandler']]
  [ModifierList/Annotation[@SimpleName = 'ResponseStatus']
     //FieldAccess[@Name = 'INTERNAL_SERVER_ERROR']]
  [not(.//MethodCall[@MethodName = ('error', 'warn')]
                    [*[1][matches(@Name, '^(log|logger|LOG|LOGGER)$')]])]

PMD custom rule, in backend/config/pmd-ruleset.xml

Your own rules need triage too

• First draft: "every catch that does not rethrow must log"
• It flagged 1 of Project Pulse's 11 catch blocks: PathVariables.readId
• That catch returns null on purpose: unresolvable means access denied

Same idea, other tools

The agent drafts, you specify

Null safety: JSpecify and NullAway

• @NullMarked on a package: everything is non-null by default
• @Nullable marks where null is legal
• NullAway checks it at compile time, and fails the build
• Spring Boot 4 is already annotated this way

Demo: NullAway on one package

public Integer getUserId() {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    if (auth == null || !auth.isAuthenticated()) return null;
    ...
    return null;
}

NullAway: 14 errors in team.projectpulse.system

Undecidable becomes a type check

// CourseService
public @Nullable Course findCourseById(Integer courseId) {
    return this.courseRepository.findById(courseId).orElse(null);
}
// CourseController
Course course = this.courseService.findCourseById(courseId);
CourseDto courseDto = this.courseToCourseDtoConverter.convert(course);

CourseController.java:[46,71] passing @Nullable parameter 'course' where @NonNull is required

Dataflow: source, sanitizer, sink

flowchart LR
  S[Source: request parameter] --> Z{Sanitizer?}
  Z -->|parameterized query| OK[Safe]
  Z -->|string concatenation| K[Sink: SQL string]

CodeQL default setup: free on public repositories, Java needs no build.

CodeQL's one finding

.csrf(csrf -> csrf.disable())

java/spring-disabled-csrf-protection · High · SecurityConfiguration

Most of your code is other people's

• Project Pulse declares 26 dependencies; Maven resolves 263
• Log4Shell, December 2021: the bug was in a library, not in anyone's own code
• Dependabot: alerts on known CVEs, opens the update pull requests

A clean report can miss the point

FROM eclipse-temurin:21-jre
WORKDIR /application
COPY --from=builder /builder/extracted/application/ ./
ENTRYPOINT ["java", "-jar", "application.jar"]

Hadolint: no findings. The app ran as root (fall 2026).

Your scanner is in your supply chain

Nobody's workflow file changed. About twelve hours.

A tag is a promise, a SHA is a fact

Dependabot proposes the next SHA; a person reviews it.

The agent and the analyzer

Your week

• Wednesday: CI/CD, these checks in the pipeline
• Friday studio: first run on your repository, gate required on main, plant one bug, write it in 8.2; optional: one rule of your own
• From now on, before every push: ./mvnw verify, not ./mvnw test
• Assignment 4, Triage the analyzers: released Wednesday, due date on the schedule