uber/NullAway
NullAway
NullAway ist ein statisches Analysetool für Java und ein Build-Time-Detektor, der darauf ausgelegt ist, Null-Pointer-Risiken zu identifizieren. Es fungiert als Nullability-Checker, der Annotationen verwendet, um zu verifizieren, dass Referenzen nicht null sind, bevor sie dereferenziert werden, wodurch Laufzeitabstürze verhindert werden.
Der Analysator implementiert den JSpecify-Standard, um konsistente Nullability-Annotationen über verschiedene Java-Bibliotheken hinweg sicherzustellen. Er zeichnet sich durch die Verwendung eines Service-Provider-Interfaces aus, um das Nullability-Verhalten von Drittanbieter-Bibliotheken ohne Quellcode-Annotationen zu modellieren, und bietet spezialisierte Unterstützung für Lombok-generierten Code.
Das Tool deckt ein breites Spektrum an Funktionen zur Sicherheitsdurchsetzung ab, einschließlich der Validierung von Java-API-Verträgen für Methoden-Overrides und der Erkennung des Abrufs leerer Optional-Werte. Die Analyseoberfläche erstreckt sich auf die Nullability-Markierung auf Paketebene und die Möglichkeit, generierten Quellcode von der Analyse auszuschließen.
Features
- Null Safety Enforcement - Provides compile-time analysis to detect null pointer risks and enforce null safety across Java codebases.
- Nullability Standard Implementations - Implements the JSpecify standard to ensure consistent nullability annotations across different Java libraries.
- Nullability Checkers - Functions as a nullability checker that uses annotations to verify references are not null before dereferencing.
- Java Static Analysis Tools - Serves as a full static analysis tool for Java source code to enforce null safety rules.
- Build-Time Null Check Verification - Provides a compiler-integrated check that identifies null pointer risks in Java projects during the build phase.
- Nullability Annotations - Provides a standardized set of nullability annotations to ensure consistent interpretation across static analysis tools.
- Syntax Tree Analysis - Analyzes the program's abstract syntax tree to track nullability states across variables and method calls.
- Null Pointer Exception Detection - Performs local type-based checks using annotations to ensure dereferenced pointers are not null.
- Static Code Analysis - Integrates automated null checks into the build process to detect potential crashes before deployment.
- Method Contract Verification - Ensures that overriding methods maintain consistent nullability contracts with their super-type methods.
- Static Contract Analysis - Performs compile-time verification of behavioral contracts to reason about method nullability.
- Third Party Library Typing - Provides a way to define nullability behavior for external libraries that lack native annotations.
- Lombok AST Integration - Recognizes common Lombok annotations to maintain compatibility with in-memory modifications of the abstract syntax tree.
- Nullability Contract Linting - Verifies that method overrides and library calls maintain consistent nullability rules to prevent runtime crashes.
- Behavioral Contract Validation - Evaluates behavioral contract annotations to reason about method side effects and return values.
- Compiler-Integrated Analysis - Integrates directly into the Java compilation process to perform analysis with minimal impact on build speed.
- Pluggable Service Provider Interfaces - Uses a pluggable service provider interface to model nullability for third-party libraries lacking source annotations.
- Optional Value Validations - Detects calls to retrieve values from empty optionals unless a presence check is performed first.
- Package-Level Nullability Marking - Applies nullability rules to entire packages to avoid requiring annotations on every individual class.
- Standardized Nullability Analyzers - Provides an analysis engine that supports the JSpecify standard for consistent nullability across Java libraries.
- Code Analysis - Build-time tool to eliminate NullPointerExceptions.
- Static Analysis Tools - Type-based null-pointer checker for Java.
