facebook / infer

A static analyzer for Java, C, C++, and Objective-C
http://fbinfer.com/
MIT License
14.93k stars 2.01k forks source link

[java] extract the classes when analyzing JAR files with the dependency mode enabled #1707

Closed jeremydubreil closed 1 year ago

jeremydubreil commented 1 year ago

Java applications are deployed by shipping the first party code together with the list of third party dependencies. However, there are different approaches to package all the classes. The WAR files will store the classes under /WEB-INF/classes whereas frameworks like Spring Boot can be used to create application JAR with a custom Java bootloader.

Extracting all the classes is a temporary solution to help with the discovery of all the classes that are part of the Java application even for case where the JAR files are following a non-standard packaging method (meaning that they would make the Javalib class discovery method fail in this case).

This feature is gated by the --dependencies and has no effect on the standard deployment model based on the build integration.

Extracting all the classes is suboptimal and has an impact on the performance when running with the --dependencies mode is enabled, even when running on a valid JAR file (according to the Java class loading standard). However, the goal is to fix the functionality as a first step and improve the performance later once we understand how to search for classes in any jar file without having to extract the content.