8 ms·

PMD source code analyzer

70 points by BuuQu9hu 10y ago

caseysoftware 10y ago
Wow, crazy to see this project still alive and thriving. I was using it 10+ years ago when I worked exclusively in Java. It was great to find those "obvious" issues that slip in that you didn't notice when you should of. I think I had it as a SVN pre-commit hook at one point. In fact, the lead dev wrote a book "PMD Applied" and I wrote a review of it: http://caseysoftware.com/blog/book-review-pmd-applied http://caseysoftware.com/blog/book-review-pmd-applied It's since been implemented in PHP too: https://phpmd.org/ https://phpmd.org/
- blater 10y ago
  yeah, nice to see PMD still getting some love. A very well implemented tool that just does what it does awesomely well.
- tcopeland 10y ago
  I remember you writing that, thanks Keith!
bastijn 10y ago
Since it is not on the front page and probably everybody wants to know. Here is what it claims to do. "PMD scans source code in Java and other languages and looks for potential problems like: - Possible bugs - empty try/catch/finally/switch statements - Dead code - unused local variables, parameters and private methods - Suboptimal code - wasteful String/StringBuffer usage Overcomplicated expressions - unnecessary if statements, for loops that could be while loops - Duplicate code - copied/pasted code means copied/pasted bugs" [0] http://pmd.sourceforge.net/snapshot/ http://pmd.sourceforge.net/snapshot/
- tcopeland 10y ago
  At one point Sven Jacob added some data flow analysis. It was interesting stuff; I feel like we could have taken that a lot further. But anyhow, the combination of PMD and FindBugs can find quite a few bugs that would be hard to track down otherwise.
rickette 10y ago
I'm not sure why this is on the frontpage since PMD (like Checkstyle and FindBugs) has been around for years. Still If your not familiar with PMD you should take a look. Anyway these days you probably want to invest in setting up SonarQube which is a superior tool in many ways (multi-language code analysis with webbassd dashboard etc)
- nradov 10y ago
  Yes agreed. FindBugs appears to be kind of defunct anyway; there hasn't been a release since 2015 and the main developer isn't working on it any more. SonarSource has been gradually dropping the PMD and FindBugs rules from SonarQube and writing their own replacements.
Ace17 10y ago
Some usage examples on the front page would have been nice.
xvilka 10y ago
I wonder how it's comparable with Infer [1]. 1. https://github.com/facebook/infer https://github.com/facebook/infer
mmrezaie 10y ago
I rarely write a bad code, just joking! But has anyone used the emacs plug-in for it? And is it any good?
- adtac 10y ago
  FWIW we have an emacs plugin[1] for coala, which supports PMD. [1] https://github.com/coala/coala-emacs https://github.com/coala/coala-emacs
  - mmrezaie 10y ago
    Very interesting. I never used anything like pmd and I thought these tools are only available with advanced IDEs.
underyx 10y ago
Here's a shameless plug for https://coala.io/ https://coala.io/ which is a sort of a meta-linter — coala can run PMD on your code along with ~100 other linters and code checkers.
- thecupisblue 10y ago
  Oh wow! Awesome, gonna try it out today on my Android project, didn't know it existed!
- zellyn 10y ago
  If you're a Go programmer, there's a Go-specific metalinter: https://github.com/alecthomas/gometalinter https://github.com/alecthomas/gometalinter
  - deleted 10y ago
    [deleted]
  - underyx 10y ago
    This seems especially useful when you don't want to think about how to set up linting, and what rules you want to use. There's a similar tool for Python, called prospector: https://github.com/landscapeio/prospector https://github.com/landscapeio/prospector With coala you need to configure which linters run on which files, and we recognize this as a thing we can improve upon. We're soon going to ship a feature which will allow configuration to just specify where the files are (e.g. 'src/*.py') and what aspects to check (e.g. 'syntax,smells,duplication,security'). Then coala will decide which tools are appropriate, get them from pip/npm/wherever, and run them.
    - BuuQu9hu 10y ago
      check-all-the-things does exactly that already. Only knows about Debian dependencies so far though and still working on how to do automatic installs.
- epage 10y ago
  Well, I guess I don't need to worry about open sourcing my meta linter but instead look into adopting this. Drat, I liked the name "Red Herring".
TeMPOraL 10y ago
I've checked out Coala, I've been using FindBugs and SonarQube in the past, and sadly, all of the solutions I've seen miss support for Lisp language family. I could use some kind of linter for my Common Lisp code.
- sils 10y ago
  Hey, would it help you if we were to include https://github.com/fukamachi/sblint https://github.com/fukamachi/sblint in coala? Do you know other tools? We could easily integrate them using https://api.coala.io/en/latest/Developers/Writing_Linter_Bears.html https://api.coala.io/en/latest/Developers/Writing_Linter_Bea... if there's concrete interest
  - TeMPOraL 10y ago
    There was "Lisp critic" file floating around, but I've lost track of it. I don't know of any other tools. I haven't used the one you linked to yet (thanks for the link!). Seems like it could be useful.

70 points by BuuQu9hu 10y ago

Wow, crazy to see this project still alive and thriving. I was using it 10+ years ago when I worked exclusively in Java. It was great to find those "obvious" issues that slip in that you didn't notice when you should of. I think I had it as a SVN pre-commit hook at one point. In fact, the lead dev wrote a book "PMD Applied" and I wrote a review of it: http://caseysoftware.com/blog/book-review-pmd-applied http://caseysoftware.com/blog/book-review-pmd-applied It's since been implemented in PHP too: https://phpmd.org/ https://phpmd.org/

blater 10y ago
yeah, nice to see PMD still getting some love. A very well implemented tool that just does what it does awesomely well.
tcopeland 10y ago
I remember you writing that, thanks Keith!

bastijn 10y ago

Since it is not on the front page and probably everybody wants to know. Here is what it claims to do. "PMD scans source code in Java and other languages and looks for potential problems like: - Possible bugs - empty try/catch/finally/switch statements - Dead code - unused local variables, parameters and private methods - Suboptimal code - wasteful String/StringBuffer usage Overcomplicated expressions - unnecessary if statements, for loops that could be while loops - Duplicate code - copied/pasted code means copied/pasted bugs" [0] http://pmd.sourceforge.net/snapshot/ http://pmd.sourceforge.net/snapshot/

tcopeland 10y ago
At one point Sven Jacob added some data flow analysis. It was interesting stuff; I feel like we could have taken that a lot further. But anyhow, the combination of PMD and FindBugs can find quite a few bugs that would be hard to track down otherwise.

rickette 10y ago

I'm not sure why this is on the frontpage since PMD (like Checkstyle and FindBugs) has been around for years. Still If your not familiar with PMD you should take a look. Anyway these days you probably want to invest in setting up SonarQube which is a superior tool in many ways (multi-language code analysis with webbassd dashboard etc)

nradov 10y ago
Yes agreed. FindBugs appears to be kind of defunct anyway; there hasn't been a release since 2015 and the main developer isn't working on it any more. SonarSource has been gradually dropping the PMD and FindBugs rules from SonarQube and writing their own replacements.

Ace17 10y ago

Some usage examples on the front page would have been nice.

xvilka 10y ago

I wonder how it's comparable with Infer [1]. 1. https://github.com/facebook/infer https://github.com/facebook/infer

mmrezaie 10y ago

I rarely write a bad code, just joking! But has anyone used the emacs plug-in for it? And is it any good?

adtac 10y ago
FWIW we have an emacs plugin[1] for coala, which supports PMD. [1] https://github.com/coala/coala-emacs https://github.com/coala/coala-emacs
- mmrezaie 10y ago
  Very interesting. I never used anything like pmd and I thought these tools are only available with advanced IDEs.

underyx 10y ago

Here's a shameless plug for https://coala.io/ https://coala.io/ which is a sort of a meta-linter — coala can run PMD on your code along with ~100 other linters and code checkers.

thecupisblue 10y ago
Oh wow! Awesome, gonna try it out today on my Android project, didn't know it existed!
zellyn 10y ago
If you're a Go programmer, there's a Go-specific metalinter: https://github.com/alecthomas/gometalinter https://github.com/alecthomas/gometalinter
- deleted 10y ago
  [deleted]
- underyx 10y ago
  This seems especially useful when you don't want to think about how to set up linting, and what rules you want to use. There's a similar tool for Python, called prospector: https://github.com/landscapeio/prospector https://github.com/landscapeio/prospector With coala you need to configure which linters run on which files, and we recognize this as a thing we can improve upon. We're soon going to ship a feature which will allow configuration to just specify where the files are (e.g. 'src/*.py') and what aspects to check (e.g. 'syntax,smells,duplication,security'). Then coala will decide which tools are appropriate, get them from pip/npm/wherever, and run them.
  - BuuQu9hu 10y ago
    check-all-the-things does exactly that already. Only knows about Debian dependencies so far though and still working on how to do automatic installs.
epage 10y ago
Well, I guess I don't need to worry about open sourcing my meta linter but instead look into adopting this. Drat, I liked the name "Red Herring".

TeMPOraL 10y ago

I've checked out Coala, I've been using FindBugs and SonarQube in the past, and sadly, all of the solutions I've seen miss support for Lisp language family. I could use some kind of linter for my Common Lisp code.

sils 10y ago
Hey, would it help you if we were to include https://github.com/fukamachi/sblint https://github.com/fukamachi/sblint in coala? Do you know other tools? We could easily integrate them using https://api.coala.io/en/latest/Developers/Writing_Linter_Bears.html https://api.coala.io/en/latest/Developers/Writing_Linter_Bea... if there's concrete interest
- TeMPOraL 10y ago
  There was "Lisp critic" file floating around, but I've lost track of it. I don't know of any other tools. I haven't used the one you linked to yet (thanks for the link!). Seems like it could be useful.