Static analysis

As explained in 100 Java Mistakes and How to Avoid Them

A static analysis tool is software that examines code without executing it to detect defects, policy violations, or other properties.

Static analysis examines code without running it and flags suspicious, confusing, or likely erroneous patterns. It acts like automated code review for recurring mistakes, but it does not replace human review: pattern-based checks miss many defects that a person can recognize. section 1.3

Use editor analysis for immediate feedback and whole-project or CI analysis for broader reporting. In-editor checks are convenient but typically perform limited interprocedural analysis, so changes can affect call sites that are not currently visible. section 1.3.3

Treat findings as evidence to investigate, not commands to obey:

• Inspect the language behavior and intent before accepting a quick fix; added parentheses can preserve a wrong shift expression rather than correct it. section 2.1.1
• Configure rules for the project rather than accepting irrelevant advice, such as a logging recommendation for a small research program. section 1.3.3
• Suppress a justified finding at the narrowest possible scope and explain why; broad suppression can hide later, useful warnings. section 1.3.4
• Combine analysis with code review and automated tests, because each technique catches different bug classes. section 1.8

Incorrect shift amount

In Java, shifting an int by 32 bits has no effect and is likely erroneous. IDE plugins can underline the expression, list it as a problem, and offer the rule description or controls to deactivate it. section 1.3.2

Java tooling ranges from IDE inspections and plugins such as IntelliJ IDEA and SonarLint to build-integrated Error Prone. Other options include PMD, SpotBugs, PVS-Studio, and CodeQL; their analysis depth, language coverage, and integration differ. section 1.3.1 section 1.3.2

Figure 1.5 A static analysis additional warning menu that allows you to suppress the warning, edit inspection options, or disable the inspection

Use the warning menu to examine an inspection before choosing a local suppression, changing its options, or disabling it. section 1.3.2

How 100 Java Mistakes and How to Avoid Them covers it

How deep it goes

Explains tool integration, online versus offline scope, configuration, and suppression, while cautioning that pattern checks miss defects.

Examples

Uses a 32-bit int shift warning, misleading shift-parenthesis quick fix, unused debug collection, and assert-side-effect detection.

What you can do after

Apply it via IDE plugins or build integration, then configure and narrowly suppress findings with judgment.

How it connects

Connects static analysis with code review, automated testing, assertions, continuous integration, and interprocedural analysis.

liveBookmanning.com

Read 100 Java Mistakes and How to Avoid Them on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Authorization in ActionStatic analysis is the examination of programs or policies without executing them to identify properties, errors, or behavioral consequences.
• 

  liveBookmanning.com
  Effective Platform EngineeringStatic analysis is the automated examination of source code or related artifacts without executing the analyzed software.
• 

  liveBookmanning.com
  Infrastructure as Code, Patterns and Practices: With examples in Python and TerraformStatic analysis is the examination of source code or configuration without executing or deploying it to detect errors, inconsistencies, or violations of specified standards.
• 

  liveBookmanning.com
  Shipping Go: Develop, deliver, discuss, design, and go againStatic code analysis is the automated examination of source code without executing it to identify defects, suspicious constructs, style violations, or security risks.
• 

  liveBookmanning.com
  Data Pipelines with Apache Airflow, Second EditionStatic code analysis is the examination of source code without executing it to detect defects, style violations, or other issues.

Compare how 6 books explain static analysis →

Related concepts

• autocompleteused by · Autocomplete is an interactive input feature that suggests or completes likely continuations of partially entered text, code, commands, or other values.
• dynamic analysiscontrasts with · Dynamic analysis is the examination of a program, model, or system by observing its behavior during execution or operation.
• code reviewcontrasts with · Code review is the systematic examination of source code or proposed changes to identify problems and assess or improve quality.
• deployment pipelineused by · A sequence of automated or manual stages that builds, tests or validates, packages, and delivers software or models toward deployment.
• lintingincludes · Linting is the automated static analysis of source code or configuration against rules to identify potential errors, suspicious patterns, and style or consistency violations.

This explainer was generated by Manning's knowledge graph from the text of 100 Java Mistakes and How to Avoid Them. The section links point to the parts of the book it draws on.