JSR-305: Annotations for Software Defect Detection

JSR-305: Annotations for Software Defect Detection

Static Analysis tools such as FindBugs, IntelliJ, Checkstyle and PMD are widely used in Java development. The tools are sophisticated, but there are a common set of problems which they handle poorly. These are generally implicit design decisions in the APIs such as where a value can be null, or where a numeric value is not expected to be negative. In Java, a well written API will capture these design details in the JavaDoc but they are not easily accessible to the analysis tools and, in consequence, may either be missed or result in false positives.

To work around this problem a number of static analysis tool developers are exploring using annotations to define these details. For example FindBugs and IntelliJ both define their own annotations to indicate when a method may return null. The two tools use slightly different annotations however and so there is a case for standardisation. JSR-305, led by FindBugs' creator Bill Pugh, is looking to create both a standard set of annotations that analysis tools can use, and a mechanism to allow developers to add additional annotations as they need to. The current proposal includes annotations for nullness, sign, language, and threading amongst others.

In a tech talk Bill Pugh gave at Google he goes through a number of concrete examples, starting with nullness. The idea is to allow a method to define parameters, return values and fields that should always be nonnull, and those whose arguments should accept a null. Pugh's solution involves using three annotations:
@Nonnull - interpreted as should be nonnull after the object is initialised.
@NullFeasible - code should always worry that this value might be null. Tools should flag any dereference that isn't preceded by a null check. If you mark a return value as NullFeasible you may have to go through a number of other code changes as the effects of a possible null parameter ripple through the code.
@UnknownNullness - this is the same as no annotation but is needed to support default and inherited annotations.

Read full article from JSR-305: Annotations for Software Defect Detection