{"action":"created","issue":{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/309","repository_url":"https://api.github.com/repos/ESAPI/esapi-java-legacy","labels_url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/309/labels{/name}","comments_url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/309/comments","events_url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/309/events","html_url":"https://github.com/ESAPI/esapi-java-legacy/issues/309","id":48672682,"number":309,"title":"Eliminate eclipse code warnings to improve quality","user":{"login":"meg23","id":814859,"avatar_url":"https://avatars.githubusercontent.com/u/814859?v=3","gravatar_id":"","url":"https://api.github.com/users/meg23","html_url":"https://github.com/meg23","followers_url":"https://api.github.com/users/meg23/followers","following_url":"https://api.github.com/users/meg23/following{/other_user}","gists_url":"https://api.github.com/users/meg23/gists{/gist_id}","starred_url":"https://api.github.com/users/meg23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/meg23/subscriptions","organizations_url":"https://api.github.com/users/meg23/orgs","repos_url":"https://api.github.com/users/meg23/repos","events_url":"https://api.github.com/users/meg23/events{/privacy}","received_events_url":"https://api.github.com/users/meg23/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/labels/imported","name":"imported","color":"FFFFFF"},{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/labels/Maintainability","name":"Maintainability","color":"FFFFFF"},{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/labels/Priority-Low","name":"Priority-Low","color":"FFFFFF"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2014-11-13T18:26:44Z","updated_at":"2016-02-04T05:30:48Z","closed_at":null,"body":"_From [eamonn.w...@gmail.com](https://code.google.com/u/104114803397285871233/) on June 21, 2013 07:53:13_\n\nHi, I integrated ESAPI into a large legacy application last year and am very happy with it!\r\n\r\nHowever we use eclipse and set all eclipse compiler preferences to Error (instead of Warning or Ignore) for the categories \"Potential programming problems\" and \"Unnecessary code\" (except 'value of parameter is not used'). Additionally for JavaDoc 'Malformed Javadoc comments' is also an error.  Altogether this shows 339 \"errors\" in ESAPI, which include what could be considered bugs (eg potential null pointer access),  efficiency issues (eg boxing and unboxing) and nice-to-haves.\r\n\r\nI say all this because it would be nice to see these 'errors' disappear from our eclipse baseline, but it would also improve the quality of the ESAPI deliverable.  If you do not use eclipse I could upload a list of the 339 issues.\r\n\r\nThanks\r\nEamonn\n\n_Original issue: http://code.google.com/p/owasp-esapi-java/issues/detail?id=303_"},"comment":{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/comments/179649244","html_url":"https://github.com/ESAPI/esapi-java-legacy/issues/309#issuecomment-179649244","issue_url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/309","id":179649244,"user":{"login":"chrisisbeef","id":622346,"avatar_url":"https://avatars.githubusercontent.com/u/622346?v=3","gravatar_id":"","url":"https://api.github.com/users/chrisisbeef","html_url":"https://github.com/chrisisbeef","followers_url":"https://api.github.com/users/chrisisbeef/followers","following_url":"https://api.github.com/users/chrisisbeef/following{/other_user}","gists_url":"https://api.github.com/users/chrisisbeef/gists{/gist_id}","starred_url":"https://api.github.com/users/chrisisbeef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrisisbeef/subscriptions","organizations_url":"https://api.github.com/users/chrisisbeef/orgs","repos_url":"https://api.github.com/users/chrisisbeef/repos","events_url":"https://api.github.com/users/chrisisbeef/events{/privacy}","received_events_url":"https://api.github.com/users/chrisisbeef/received_events","type":"User","site_admin":false},"created_at":"2016-02-04T05:30:48Z","updated_at":"2016-02-04T05:30:48Z","body":"This. A million times this.\nOn Feb 3, 2016 8:42 PM, \"Kevin W. Wall\" <notifications@github.com> wrote:\n\n> The problem with any SAST tool is that they find a lot of false positives.\n> Often more false positives than real issues. And even if you can \"shut off\"\n> those false positives complaints with annotations of some kind, there's\n> always some other favorite SAST tool that finds the same false positives\n> but rely on different annotations to shut them up. (A great example is the\n> use of the term 'password' in a comment or as a variable name; many SAST\n> tools incorrectly identify this as a \"hard-coded password\".) I've already\n> addressed these findings for all the crypto related code using findbugs,\n> PMD, SWAMP, and HP Fortify but left all the false positives. And since many\n> of those tools do not rely on annotations to shut them (e.g., HP Fortify),\n> there's no way to get rid of them for everyone (sort of sharing say, the\n> analyzed .fpr in the Fortify case, etc.). And if you add on error checks\n> performed by various IDEs, you have a never ending battle.\n>\n> The problem with any SAST tool is that they find a lot of false positives.\n> Often more false positives than real issues. And even if you can \"shut off\"\n> those false positives complaints with annotations of some kind, there's\n> always some other favorite SAST tool that finds the same false positives\n> but rely on different annotations to shut them up. (A great example is the\n> use of the term 'password' in a comment or as a variable name; many SAST\n> tools incorrectly identify this as a \"hard-coded password\".)\n>\n> For that reason, I have removed the 'enhancement' label for this and added\n> a 'maintainability' label ('reliability' might be more accurate, but I'm\n> too lazy at the moment to go off and create that new lable) as well as\n> labeling this issue as a low priority. (I was really tempted to add the\n> 'PITA' label as well.)\n>\n> My impression is that we should be cognizant of \"errors\" / warnings and\n> fix them when there are actual issues present, and when not, either add the\n> appropriate annotation to suppress them or perhaps mimimally add a comment.\n> But I personally do NOT believe that it is worth the time to methodically\n> go through all such warnings and try to address them in one fell swoop.\n> There are way more important ESAPI bugs to squash.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/ESAPI/esapi-java-legacy/issues/309#issuecomment-179602404>\n> .\n>\n"}}