You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@accumulo.apache.org by GitBox <gi...@apache.org> on 2018/08/27 18:25:22 UTC
[GitHub] ctubbsii commented on a change in pull request #615: Upgrade
findbugs to spotbugs + Add secbugs plugin
ctubbsii commented on a change in pull request #615: Upgrade findbugs to spotbugs + Add secbugs plugin
URL: https://github.com/apache/accumulo/pull/615#discussion_r213065880
##########
File path: pom.xml
##########
@@ -793,22 +793,30 @@
</configuration>
</plugin>
<plugin>
- <groupId>org.codehaus.mojo</groupId>
- <artifactId>findbugs-maven-plugin</artifactId>
+ <groupId>com.github.spotbugs</groupId>
+ <artifactId>spotbugs</artifactId>
<version>${findbugs.version}</version>
<configuration>
<xmlOutput>true</xmlOutput>
<effort>Max</effort>
<failOnError>true</failOnError>
<includeTests>true</includeTests>
<maxRank>16</maxRank>
+ <!-- findbugs plugin for webapp security bugs -->
+ <includeFilterFile>${session.executionRootDirectory}/spotbugs-security-include.xml</includeFilterFile>
+ <excludeFilterFile>${session.executionRootDirectory}/spotbugs-security-exclude.xml</excludeFilterFile>
Review comment:
I don't think this path will work in all cases (has it been tested with Jenkins?). Also, it'd be better not to have these files clutter the root directory.
The `excludeFilterFile` is also optional, and setting it here globally is going to conflict with the `add-findbugs-excludes` profile which sets the property for excludes. If we set the xml config here for the `excludeFilterFile`, then the property will be ignored when that profile is activated.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services