平息静态：静态分析警报抑制研究
Quieting the Static: A Study of Static Analysis Alert Suppressions
AI总结：
本研究通过分析1,425个Java项目，揭示了静态分析警告抑制的使用模式，发现误报占比小但技术债务显著，强调需改进工具沟通与教育以提升静态分析有效性。
摘要：
静态分析工具通常用于在代码发布前检测缺陷。以往的研究集中于其整体有效性和检测缺陷的能力。然而，关于警告抑制的使用模式知之甚少：即开发者为了阻止特定警告出现而设置的配置。我们通过分析警告抑制功能的使用频率、使用哪些警告抑制功能及其目的，以及如何避免使用警告抑制注释来解决这一空白。为回答这些问题，我们检查了1,425个使用Findbugs或Spotbugs进行警告抑制配置和源代码注释的开源Java项目。我们发现，尽管大多数警告被抑制，但只有一小部分被频繁抑制。与预期相反，误报仅占抑制的一小部分。大量抑制引入了技术债务，暗示着对代码质量的潜在忽视或缺乏来自工具的适当指导。误导性建议和错误假设也导致了抑制。研究结果强调了在静态分析工具使用方面加强沟通和教育、改进缺陷模式定义以及更好的代码注释的必要性。未来研究可将这些发现扩展到其他静态分析工具，并应用它们来提高静态分析的有效性。
英文摘要：
Static analysis tools are commonly used to detect defects before the code is released. Previous research has focused on their overall effectiveness and their ability to detect defects. However, little is known about the usage patterns of warning suppressions: the configurations developers set up in order to prevent the appearance of specific warnings. We address this gap by analyzing how often are warning suppression features used, which warning suppression features are used and for what purpose, and also how could the use of warning suppression annotations be avoided. To answer these questions we examine 1\,425 open-source Java-based projects that utilize Findbugs or Spotbugs for warning-suppressing configurations and source code annotations. We find that although most warnings are suppressed, only a small portion of them get frequently suppressed. Contrary to expectations, false positives account for a minor proportion of suppressions. A significant number of suppressions introduce technical debt, suggesting potential disregard for code quality or a lack of appropriate guidance from the tool. Misleading suggestions and incorrect assumptions also lead to suppressions. Findings underscore the need for better communication and education related to the use of static analysis tools, improved bug pattern definitions, and better code annotation. Future research can extend these findings to other static analysis tools, and apply them to improve the effectiveness of static analysis.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
