Coverity for Java static analysis

java static-analysis coverity-prevent
auramo picture auramo · Oct 6, 2008 · Viewed 13k times · Source

I'd like to get comments from people who have used or evaluated Coverity for statically analysing Java-code. I know it's popular in C/C++ world, but is it worth spending the money for Java analysis or am I better off with PMD, Findbugs and other Open Source tools?

Answer

Jim picture Jim · Oct 31, 2008

If you aren't using anything today, I would start off with Findbugs and PMD. They are easy to install and use. Concentrate on reviewing and fixing correctness errors with Findbugs first - they recommend starting with High and Medium severity correctness errors as the checkers have very low false positives and you will get a good return on your time. Get developers to use PMD to cleanup the code, and the Findbugs plugin in Eclipse to review new code. Working incrementally will get the developers to understand and buy-in to the usefulness of these tools.

Coverity's Java checkers are still weak compared to their C/C++ checkers. We use Findbugs, PMD, Coverity and Klocwork because they all have different strengths and we are paranoid. If you aren't paranoid, you could stick with open source tools and get a lot of value. Or if you need security checking: then Klocwork or especially Fortify should do a more thorough job for you.

Related questions

javax.annotation: @Nullable vs @CheckForNull

What is the difference between the two? Both seem to mean that the value may be null and should be dealt with accordingly i.e. checked for null. Update: The two annotations above are part of JSR-305/FindBugs: http://findbugs.…

Read More
Checkstyle vs. PMD

We are introducing static analysis tools into the build system for our Java product. We are using Maven2 so Checkstyle and PMD integration come for free. However it looks like there is a large overlap in functionality between these two …

Read More
Static Analysis tool recommendation for Java?

Being vaguely familiar with the Java world I was googling for a static analysis tool that would also was intelligent enough to fix the issues it finds. I ran at CodePro tool but, again, I'm new to the Java community …

Read More