PMD source code analyzer(pmd.github.io)

70 pointsby BuuQu9huvor 10 Jahren34 comments

pmd.github.io

https://pmd.github.io/

8 comments

underyxvor 10 Jahren

Here's a shameless plug for https://coala.io/ which is a sort of a meta-linter — coala can run PMD on your code along with ~100 other linters and code checkers.

BuuQu9huvor 10 Jahren

Another meta-linter:

https://anonscm.debian.org/cgit/collab-maint/check-all-the-t...

adtacvor 10 Jahren

Actually, coala is not entirely a meta-linter - we have a few native linters that we wrote ourselves too. However, a large chunk is external linters.

BuuQu9huvor 10 Jahren

It might be interesting to split those native linters out into separate projects so that other meta-linters like flycheck, check-all-the-things, various IDEs etc can also use them.

adtacvor 10 Jahren

Indeed. However, you can run just those native linters with coala too (on specific files or entire projects). And we currently have plugin support for a few editors.

BuuQu9huvor 10 Jahren

Do your linters support the Firehose static analysis results format?

adtacvor 10 Jahren

I'm not entirely sure what that format is, but coala can be formatted to output in any format you want using a `--format` flag. You have the result components such as message, line number, line, and several other parameters and you can build your own line.

And if that's not enough, you can also output as JSON.

Edit: and this applies to all linters - native and external.

BuuQu9huvor 10 Jahren

https://github.com/fedora-static-analysis/firehose

adtacvor 10 Jahren

Interesting. I just took a look at the examples.

We don't have support for SHA-1 sums for example, but these could be added very easily.

I've created an issue to support this in coala: https://github.com/coala/coala/issues/3525

Thanks!

BuuQu9huvor 10 Jahren

What is the command for only running the native linters?

adtacvor 10 Jahren

There isn't really a command for just native linters - there is practically no difference between a native one and an external one.

You could take a look at the list of bears we support[1] (a bear is basically a plugin) though.

[1] https://github.com/coala/bear-docs

BuuQu9huvor 10 Jahren

Is there a way to disable the non-native linters?

adtacvor 10 Jahren

You can specify exactly which linters you want though a coafile (a config file). For example, we have something called a GitCommitBear that lints your git commit messages. It's entirely written by us.

You can use just that bear:

    [Commit]
    bears = GitCommitBear
    shortlog_trailing_period = False # disallow periods at the end of the shortlog

You can have other sections too (imagine the following section is in the same file as the above):

    [LineLength]
    bears = LineLengthBear
    files = *.py
    max_line_length = 80

Again, LineLengthBear is a native solution.

Of course, you can also combine native and external linters in the same section - they are virtually the same to the user.

BuuQu9huvor 10 Jahren

Hmm, was thinking something command-line would be easier.

thecupisbluevor 10 Jahren

Oh wow! Awesome, gonna try it out today on my Android project, didn't know it existed!

zellynvor 10 Jahren

If you're a Go programmer, there's a Go-specific metalinter: https://github.com/alecthomas/gometalinter

underyxvor 10 Jahren

This seems especially useful when you don't want to think about how to set up linting, and what rules you want to use. There's a similar tool for Python, called prospector: https://github.com/landscapeio/prospector

With coala you need to configure which linters run on which files, and we recognize this as a thing we can improve upon. We're soon going to ship a feature which will allow configuration to just specify where the files are (e.g. 'src/*.py') and what aspects to check (e.g. 'syntax,smells,duplication,security'). Then coala will decide which tools are appropriate, get them from pip/npm/wherever, and run them.

BuuQu9huvor 10 Jahren

check-all-the-things does exactly that already. Only knows about Debian dependencies so far though and still working on how to do automatic installs.

[deleted]vor 10 Jahren

epagevor 10 Jahren

Well, I guess I don't need to worry about open sourcing my meta linter but instead look into adopting this.

Drat, I liked the name "Red Herring".

TeMPOraLvor 10 Jahren

I've checked out Coala, I've been using FindBugs and SonarQube in the past, and sadly, all of the solutions I've seen miss support for Lisp language family. I could use some kind of linter for my Common Lisp code.

silsvor 10 Jahren

Hey, would it help you if we were to include https://github.com/fukamachi/sblint in coala? Do you know other tools? We could easily integrate them using https://api.coala.io/en/latest/Developers/Writing_Linter_Bea... if there's concrete interest

TeMPOraLvor 10 Jahren

There was "Lisp critic" file floating around, but I've lost track of it. I don't know of any other tools.

I haven't used the one you linked to yet (thanks for the link!). Seems like it could be useful.

caseysoftwarevor 10 Jahren

Wow, crazy to see this project still alive and thriving. I was using it 10+ years ago when I worked exclusively in Java. It was great to find those "obvious" issues that slip in that you didn't notice when you should of. I think I had it as a SVN pre-commit hook at one point.

In fact, the lead dev wrote a book "PMD Applied" and I wrote a review of it: http://caseysoftware.com/blog/book-review-pmd-applied

It's since been implemented in PHP too: https://phpmd.org/

blatervor 10 Jahren

yeah, nice to see PMD still getting some love. A very well implemented tool that just does what it does awesomely well.

tcopelandvor 10 Jahren

I remember you writing that, thanks Keith!

bastijnvor 10 Jahren

Since it is not on the front page and probably everybody wants to know. Here is what it claims to do.

"PMD scans source code in Java and other languages and looks for potential problems like:

- Possible bugs - empty try/catch/finally/switch statements

- Dead code - unused local variables, parameters and private methods

- Suboptimal code - wasteful String/StringBuffer usage Overcomplicated expressions - unnecessary if statements, for loops that could be while loops

- Duplicate code - copied/pasted code means copied/pasted bugs"

[0] http://pmd.sourceforge.net/snapshot/

tcopelandvor 10 Jahren

At one point Sven Jacob added some data flow analysis. It was interesting stuff; I feel like we could have taken that a lot further. But anyhow, the combination of PMD and FindBugs can find quite a few bugs that would be hard to track down otherwise.

rickettevor 10 Jahren

I'm not sure why this is on the frontpage since PMD (like Checkstyle and FindBugs) has been around for years. Still If your not familiar with PMD you should take a look. Anyway these days you probably want to invest in setting up SonarQube which is a superior tool in many ways (multi-language code analysis with webbassd dashboard etc)

nradovvor 10 Jahren

Yes agreed. FindBugs appears to be kind of defunct anyway; there hasn't been a release since 2015 and the main developer isn't working on it any more. SonarSource has been gradually dropping the PMD and FindBugs rules from SonarQube and writing their own replacements.

Ace17vor 10 Jahren

Some usage examples on the front page would have been nice.

xvilkavor 10 Jahren

I wonder how it's comparable with Infer [1].

1. https://github.com/facebook/infer

mmrezaievor 10 Jahren

I rarely write a bad code, just joking! But has anyone used the emacs plug-in for it? And is it any good?

adtacvor 10 Jahren

FWIW we have an emacs plugin[1] for coala, which supports PMD.

[1] https://github.com/coala/coala-emacs

mmrezaievor 10 Jahren

Very interesting. I never used anything like pmd and I thought these tools are only available with advanced IDEs.