提高Java代码安全性

apply plugin: "com.github.spotbugs"
classpath "com.github.spotbugs.snom:spotbugs-gradle-plugin:4.7.8"

spotbugs 'com.github.spotbugs:spotbugs:4.4.0'
spotbugsPlugins 'com.h3xstream.findsecbugs:findsecbugs-plugin:1.12.0'

spotbugs {
	ignoreFailures = true
	showStackTraces = false
	reportsDir = file("$buildDir/spotbugs")
}

spotbugsMain {
	reports {
		html {
			required = true
			outputLocation = file("$buildDir/reports/spotbugs/main/spotbugsTest.html")
			stylesheet = 'fancy-hist.xsl'
		}
	}
}

public class XmlDecoderDetectorTest extends BaseDetectorTest {

    @Test
    public void detectXmlDecoder() throws Exception {

        //Locate test code
        String[] files = {       
          getClassFilePath("<main-logic-file-path>")           
        };

        //Run the analysis
		EasyBugReporter reporter = spy(new EasyBugReporter());
        analyze(files, reporter);

        //Assertions
		verify(reporter).doReportBug(
			bugDefinition().bugType("XML_DECODER")
			.inClass("<class-name>").inMethod("<method-name").atLine("<line-no>")
          	.build()
        );
    }
}

-         Findbugs.xml

<Detector class="com.h3xstream.findsecbugs.XmlDecoderDetector" reports="XML_DECODER"/>
<BugPattern type="XML_DECODER" abbrev="XMLDEC" category="SECURITY"/>

-         Messages.xml

<!-- XML decoder -->
<Detector class="com.h3xstream.findsecbugs.XmlDecoderDetector">
  <Details>Identify the use of XMLDecoder (a dangerous XML serializer).</Details>
</Detector>

<BugPattern type="XML_DECODER">
	<ShortDescription>XMLDecoder usage</ShortDescription>
	<LongDescription>It is not safe to use an XMLDecoder to parse user-supplied data</LongDescription>
	<Details><![CDATA[<p>
    XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution.
    This is possible because XMLDecoder supports arbitrary method invocation. This capability is intended to call setter methods,
    but in practice, any method can be called.</p>]]>
	</Details>
</BugPattern>

<BugCode abbrev="XMLDEC">XMLDecoder usage</BugCode>