SlideShare a Scribd company logo
Quality Assurance 
Enforcing Code Guidelines by Extending JDeveloper’s Auditing Framework
About Us 
Richard Olrichs 
MN 
www.olrichs.nl 
@richardolrichs 
Wilfred van der Deijl 
The Future Group 
www.redheap.com 
@wilfreddeijl
Agenda 
● Audit Profiles and Preferences 
● Audit JDeveloper Extension Project 
● Creating Custom Rules 
● SuppressWarnings 
● ADF EMG Audit Rules 
● Automated QA
Aborts Compile On Error
Custom Rules
Custom Rules 
● Setting up JDeveloper Extension 
Project 
● Implementing Custom Rule 
● Implementing Custom Fix
Setting up JDev Extension Project 
● Install Extension SDK (Help>CheckForUpdates) 
● File > New > Applications > 
Extension Application 
● extension.xml and MANIFEST.MF 
● Bundled as .ZIP 
● Can be distributed through custom JDeveloper 
Update Center 
(aka network drive or URL)
Violation Overload
Violation Overload 
● Even ADF Sample Application from OTN 
has 157 issues 
● Too many violations cause developers to 
ignore all of them
Violation Overload
SuppressWarnings Java Annotation 
@SuppressWarnings annotation introduced in 
Java 1.5 and tells Java Compiler to suppress 
warnings
SuppressWarnings Java Annotation 
JDeveloper 12c now also “listens” to annotation 
and suppresses warnings itself (not only javac)
JDeveloper 12c Suppression Scheme 
Why not create our own for non-Java (aka XML)?
Suppress Warnings in XML
Suppress Warnings in XML
ADF EMG Audit Rules
ADF Code Guidelines Extension 
● JDeveloper extension available today 
● ADF Code Guidelines auditing during 
development 
● Community project at java.net: adfemg-auditrules 
● Contribute and discuss at ADF EMG 
● JDeveloper 12c & JDeveloper 11g
Automated QA
OJAudit 
● Command line auditing 
● JDEV_HOME/jdev/bin/ojaudit -help 
● Output in XML/text/HTML or custom xsl
Automated QA 
● Simple solution: Run ojaudit from CI server 
and publish output 
● Benefit: Same rules during development and 
CI QA 
● @SuppressWarnings and<!-- 
SuppressWarning--> keep list of 
violations short and actionable
Automated QA 
SonarQube
SonarQube 
● Tool to manage Code Quality 
● Rules, Violations, Metrics, Test Coverage, etc 
● Free Open Source 
● Initially Java, but now 20+ languages 
● Historical data, thus trends 
● Highly extensible through plugins
ADF EMG SonarQube plugin 
● SonarQube plugin 
o runs ojaudit 
o converts ojaudit output to SonarQube violations 
● www.sonarqube.com for base product 
● Watch ADF EMG for availability of plugin 
● Not specific to ADF, but for any JDev project 
● Tested with JDeveloper 12c, but should work 
with any version
Summary 
● Audit Profiles and Preferences 
● Creating Custom Rules 
● SuppressWarnings JDev Extension 
● ADF EMG Audit Rules Extension 
● SonarQube ojaudit plugin
Further Reading 
● www.olrichs.nl 
o Index page for Audit Rules 
● www.redheap.com 
● www.adfemg.org 
o Google Groups 
● http://docs.oracle.comJDeveloper Doc (not 
ADF documentation) 
o Developing Extensions for JDeveloper 
o Java API Reference for Extension SDK
Enforcing code guidelines by extending JDeveloper’s auditing framework @OOW14

More Related Content

What's hot

Jenkins Test Automation with codeBeamer ALM
Jenkins Test Automation with codeBeamer ALMJenkins Test Automation with codeBeamer ALM
Jenkins Test Automation with codeBeamer ALM
Intland Software GmbH
 
Continuous delivery applied
Continuous delivery appliedContinuous delivery applied
Continuous delivery appliedMike McGarr
 
Dev ops
Dev opsDev ops
How to become a testing expert
How to become a testing expertHow to become a testing expert
How to become a testing expertgaoliang641
 
[FullStack NYC 2019] Effective Unit Tests for JavaScript
[FullStack NYC 2019] Effective Unit Tests for JavaScript[FullStack NYC 2019] Effective Unit Tests for JavaScript
[FullStack NYC 2019] Effective Unit Tests for JavaScript
Hazem Saleh
 
ReportPortal.io - Open Source experience. Showcase, benefits
ReportPortal.io - Open Source experience. Showcase, benefits ReportPortal.io - Open Source experience. Showcase, benefits
ReportPortal.io - Open Source experience. Showcase, benefits
COMAQA.BY
 
Automated Testing at The Speed of Headless by Alissa Lydon and Samantha Coffman
Automated Testing at The Speed of Headless by Alissa Lydon and Samantha CoffmanAutomated Testing at The Speed of Headless by Alissa Lydon and Samantha Coffman
Automated Testing at The Speed of Headless by Alissa Lydon and Samantha Coffman
Sauce Labs
 
Static Code Analysis
Static Code AnalysisStatic Code Analysis
Static Code Analysis
Obika Gellineau
 
CI/CD Overview
CI/CD OverviewCI/CD Overview
CI/CD Overview
An Nguyen
 
QA Fes 2016. Артем Быковец. Как выживать тестировщику в Agile среде
QA Fes 2016. Артем Быковец. Как выживать тестировщику в Agile средеQA Fes 2016. Артем Быковец. Как выживать тестировщику в Agile среде
QA Fes 2016. Артем Быковец. Как выживать тестировщику в Agile среде
QAFest
 
CI back to basis
CI back to basisCI back to basis
CI back to basis
Sergio Navarro Pino
 
Fault tolerance - look, it's simple!
Fault tolerance - look, it's simple!Fault tolerance - look, it's simple!
Fault tolerance - look, it's simple!
Izzet Mustafaiev
 
Continuous Delivery Agile Tour Beirut 2015
Continuous Delivery Agile Tour Beirut 2015Continuous Delivery Agile Tour Beirut 2015
Continuous Delivery Agile Tour Beirut 2015
Dimitri Baeli
 
Gopcpro
GopcproGopcpro
Gopcpro
web expert
 
Building Quality into Your DevSecOps Pipelines
Building Quality into Your DevSecOps PipelinesBuilding Quality into Your DevSecOps Pipelines
Building Quality into Your DevSecOps Pipelines
Inflectra
 
RemoteLaunch Overview Presentation (2021)
RemoteLaunch Overview Presentation (2021)RemoteLaunch Overview Presentation (2021)
RemoteLaunch Overview Presentation (2021)
Inflectra
 
Continuous Integration and Continuous Deployment in Enterprise scenario
Continuous Integration and Continuous Deployment in Enterprise scenarioContinuous Integration and Continuous Deployment in Enterprise scenario
Continuous Integration and Continuous Deployment in Enterprise scenario
Davide Benvegnù
 
QA Fes 2016. Jacek Okrojek. Website performance from user perspective
QA Fes 2016. Jacek Okrojek. Website performance from user perspectiveQA Fes 2016. Jacek Okrojek. Website performance from user perspective
QA Fes 2016. Jacek Okrojek. Website performance from user perspective
QAFest
 
Cloud load testing with Visual Studio Team Services
Cloud load testing with Visual Studio Team ServicesCloud load testing with Visual Studio Team Services
Cloud load testing with Visual Studio Team Services
Martin Hinshelwood
 

What's hot (19)

Jenkins Test Automation with codeBeamer ALM
Jenkins Test Automation with codeBeamer ALMJenkins Test Automation with codeBeamer ALM
Jenkins Test Automation with codeBeamer ALM
 
Continuous delivery applied
Continuous delivery appliedContinuous delivery applied
Continuous delivery applied
 
Dev ops
Dev opsDev ops
Dev ops
 
How to become a testing expert
How to become a testing expertHow to become a testing expert
How to become a testing expert
 
[FullStack NYC 2019] Effective Unit Tests for JavaScript
[FullStack NYC 2019] Effective Unit Tests for JavaScript[FullStack NYC 2019] Effective Unit Tests for JavaScript
[FullStack NYC 2019] Effective Unit Tests for JavaScript
 
ReportPortal.io - Open Source experience. Showcase, benefits
ReportPortal.io - Open Source experience. Showcase, benefits ReportPortal.io - Open Source experience. Showcase, benefits
ReportPortal.io - Open Source experience. Showcase, benefits
 
Automated Testing at The Speed of Headless by Alissa Lydon and Samantha Coffman
Automated Testing at The Speed of Headless by Alissa Lydon and Samantha CoffmanAutomated Testing at The Speed of Headless by Alissa Lydon and Samantha Coffman
Automated Testing at The Speed of Headless by Alissa Lydon and Samantha Coffman
 
Static Code Analysis
Static Code AnalysisStatic Code Analysis
Static Code Analysis
 
CI/CD Overview
CI/CD OverviewCI/CD Overview
CI/CD Overview
 
QA Fes 2016. Артем Быковец. Как выживать тестировщику в Agile среде
QA Fes 2016. Артем Быковец. Как выживать тестировщику в Agile средеQA Fes 2016. Артем Быковец. Как выживать тестировщику в Agile среде
QA Fes 2016. Артем Быковец. Как выживать тестировщику в Agile среде
 
CI back to basis
CI back to basisCI back to basis
CI back to basis
 
Fault tolerance - look, it's simple!
Fault tolerance - look, it's simple!Fault tolerance - look, it's simple!
Fault tolerance - look, it's simple!
 
Continuous Delivery Agile Tour Beirut 2015
Continuous Delivery Agile Tour Beirut 2015Continuous Delivery Agile Tour Beirut 2015
Continuous Delivery Agile Tour Beirut 2015
 
Gopcpro
GopcproGopcpro
Gopcpro
 
Building Quality into Your DevSecOps Pipelines
Building Quality into Your DevSecOps PipelinesBuilding Quality into Your DevSecOps Pipelines
Building Quality into Your DevSecOps Pipelines
 
RemoteLaunch Overview Presentation (2021)
RemoteLaunch Overview Presentation (2021)RemoteLaunch Overview Presentation (2021)
RemoteLaunch Overview Presentation (2021)
 
Continuous Integration and Continuous Deployment in Enterprise scenario
Continuous Integration and Continuous Deployment in Enterprise scenarioContinuous Integration and Continuous Deployment in Enterprise scenario
Continuous Integration and Continuous Deployment in Enterprise scenario
 
QA Fes 2016. Jacek Okrojek. Website performance from user perspective
QA Fes 2016. Jacek Okrojek. Website performance from user perspectiveQA Fes 2016. Jacek Okrojek. Website performance from user perspective
QA Fes 2016. Jacek Okrojek. Website performance from user perspective
 
Cloud load testing with Visual Studio Team Services
Cloud load testing with Visual Studio Team ServicesCloud load testing with Visual Studio Team Services
Cloud load testing with Visual Studio Team Services
 

Similar to Enforcing code guidelines by extending JDeveloper’s auditing framework @OOW14

JDeveloper Auditing Framework (UKOUG Tech2013)
JDeveloper Auditing Framework (UKOUG Tech2013)JDeveloper Auditing Framework (UKOUG Tech2013)
JDeveloper Auditing Framework (UKOUG Tech2013)
Wilfred van der Deijl
 
Andreas Grabner - Performance as Code, Let's Make It a Standard
Andreas Grabner - Performance as Code, Let's Make It a StandardAndreas Grabner - Performance as Code, Let's Make It a Standard
Andreas Grabner - Performance as Code, Let's Make It a Standard
Neotys_Partner
 
Continuous Development Pipeline
Continuous Development PipelineContinuous Development Pipeline
Continuous Development Pipeline
Izzet Mustafaiev
 
DevOps Pipeline for Liferay Application
DevOps Pipeline for Liferay ApplicationDevOps Pipeline for Liferay Application
DevOps Pipeline for Liferay Application
Maruti Gollapudi
 
Load Testing using Continuous Integration tools
Load Testing using Continuous Integration toolsLoad Testing using Continuous Integration tools
Load Testing using Continuous Integration tools
Rick Pitts
 
Continuous testing
Continuous testingContinuous testing
Continuous testing
Oleksandr Metelytsia
 
Understand release engineering
Understand release engineeringUnderstand release engineering
Understand release engineeringgaoliang641
 
Software Delivery in 2016 - A Continuous Delivery Approach
Software Delivery in 2016 - A Continuous Delivery ApproachSoftware Delivery in 2016 - A Continuous Delivery Approach
Software Delivery in 2016 - A Continuous Delivery Approach
Giovanni Toraldo
 
Arm html5 presentation
Arm html5 presentationArm html5 presentation
Arm html5 presentationIan Renyard
 
Security Implications for a DevOps Transformation
Security Implications for a DevOps TransformationSecurity Implications for a DevOps Transformation
Security Implications for a DevOps Transformation
Deborah Schalm
 
Security Implications for a DevOps Transformation
Security Implications for a DevOps TransformationSecurity Implications for a DevOps Transformation
Security Implications for a DevOps Transformation
DevOps.com
 
Selenium
SeleniumSelenium
Selenium
abiramimaya
 
Distributed and Scalable JMeter
Distributed and Scalable JMeterDistributed and Scalable JMeter
Distributed and Scalable JMeter
Hepsiburada
 
Creating a reasonable project boilerplate
Creating a reasonable project boilerplateCreating a reasonable project boilerplate
Creating a reasonable project boilerplate
Stanislav Petrov
 
A guide to modern software development 2018
A guide to modern software development 2018A guide to modern software development 2018
A guide to modern software development 2018
Peter Bittner
 
First Steps to DevOps
First Steps to DevOpsFirst Steps to DevOps
First Steps to DevOps
Inductive Automation
 
Introduction to CICD
Introduction to CICDIntroduction to CICD
Introduction to CICD
Knoldus Inc.
 
Dev ops presentation
Dev ops presentationDev ops presentation
Dev ops presentation
Ahmed Kamel
 
Code review automation and functional tests on Carrefour
Code review automation and functional tests on CarrefourCode review automation and functional tests on Carrefour
Code review automation and functional tests on Carrefour
Denis Santos
 
Quality Loopback
Quality LoopbackQuality Loopback
Quality Loopback
Omar Bashir
 

Similar to Enforcing code guidelines by extending JDeveloper’s auditing framework @OOW14 (20)

JDeveloper Auditing Framework (UKOUG Tech2013)
JDeveloper Auditing Framework (UKOUG Tech2013)JDeveloper Auditing Framework (UKOUG Tech2013)
JDeveloper Auditing Framework (UKOUG Tech2013)
 
Andreas Grabner - Performance as Code, Let's Make It a Standard
Andreas Grabner - Performance as Code, Let's Make It a StandardAndreas Grabner - Performance as Code, Let's Make It a Standard
Andreas Grabner - Performance as Code, Let's Make It a Standard
 
Continuous Development Pipeline
Continuous Development PipelineContinuous Development Pipeline
Continuous Development Pipeline
 
DevOps Pipeline for Liferay Application
DevOps Pipeline for Liferay ApplicationDevOps Pipeline for Liferay Application
DevOps Pipeline for Liferay Application
 
Load Testing using Continuous Integration tools
Load Testing using Continuous Integration toolsLoad Testing using Continuous Integration tools
Load Testing using Continuous Integration tools
 
Continuous testing
Continuous testingContinuous testing
Continuous testing
 
Understand release engineering
Understand release engineeringUnderstand release engineering
Understand release engineering
 
Software Delivery in 2016 - A Continuous Delivery Approach
Software Delivery in 2016 - A Continuous Delivery ApproachSoftware Delivery in 2016 - A Continuous Delivery Approach
Software Delivery in 2016 - A Continuous Delivery Approach
 
Arm html5 presentation
Arm html5 presentationArm html5 presentation
Arm html5 presentation
 
Security Implications for a DevOps Transformation
Security Implications for a DevOps TransformationSecurity Implications for a DevOps Transformation
Security Implications for a DevOps Transformation
 
Security Implications for a DevOps Transformation
Security Implications for a DevOps TransformationSecurity Implications for a DevOps Transformation
Security Implications for a DevOps Transformation
 
Selenium
SeleniumSelenium
Selenium
 
Distributed and Scalable JMeter
Distributed and Scalable JMeterDistributed and Scalable JMeter
Distributed and Scalable JMeter
 
Creating a reasonable project boilerplate
Creating a reasonable project boilerplateCreating a reasonable project boilerplate
Creating a reasonable project boilerplate
 
A guide to modern software development 2018
A guide to modern software development 2018A guide to modern software development 2018
A guide to modern software development 2018
 
First Steps to DevOps
First Steps to DevOpsFirst Steps to DevOps
First Steps to DevOps
 
Introduction to CICD
Introduction to CICDIntroduction to CICD
Introduction to CICD
 
Dev ops presentation
Dev ops presentationDev ops presentation
Dev ops presentation
 
Code review automation and functional tests on Carrefour
Code review automation and functional tests on CarrefourCode review automation and functional tests on Carrefour
Code review automation and functional tests on Carrefour
 
Quality Loopback
Quality LoopbackQuality Loopback
Quality Loopback
 

Recently uploaded

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
Uni Systems S.M.S.A.
 
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
DianaGray10
 
Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1
DianaGray10
 
RESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for studentsRESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for students
KAMESHS29
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
James Anderson
 
20240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 202420240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 2024
Matthew Sinclair
 
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AIMind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
Kumud Singh
 
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
SOFTTECHHUB
 
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdfObservability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Paige Cruz
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
Neo4j
 
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
SOFTTECHHUB
 
20240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 202420240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 2024
Matthew Sinclair
 
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdfUni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems S.M.S.A.
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Neo4j
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
ControlCase
 

Recently uploaded (20)

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
 
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
 
Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1
 
RESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for studentsRESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for students
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
 
20240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 202420240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 2024
 
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AIMind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
 
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
 
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdfObservability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
 
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
 
20240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 202420240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 2024
 
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdfUni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdf
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
 

Enforcing code guidelines by extending JDeveloper’s auditing framework @OOW14

  • 1. Quality Assurance Enforcing Code Guidelines by Extending JDeveloper’s Auditing Framework
  • 2. About Us Richard Olrichs MN www.olrichs.nl @richardolrichs Wilfred van der Deijl The Future Group www.redheap.com @wilfreddeijl
  • 3. Agenda ● Audit Profiles and Preferences ● Audit JDeveloper Extension Project ● Creating Custom Rules ● SuppressWarnings ● ADF EMG Audit Rules ● Automated QA
  • 4.
  • 6.
  • 7.
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 14. Custom Rules ● Setting up JDeveloper Extension Project ● Implementing Custom Rule ● Implementing Custom Fix
  • 15. Setting up JDev Extension Project ● Install Extension SDK (Help>CheckForUpdates) ● File > New > Applications > Extension Application ● extension.xml and MANIFEST.MF ● Bundled as .ZIP ● Can be distributed through custom JDeveloper Update Center (aka network drive or URL)
  • 16.
  • 17.
  • 18.
  • 19.
  • 20.
  • 22.
  • 23. Violation Overload ● Even ADF Sample Application from OTN has 157 issues ● Too many violations cause developers to ignore all of them
  • 25. SuppressWarnings Java Annotation @SuppressWarnings annotation introduced in Java 1.5 and tells Java Compiler to suppress warnings
  • 26. SuppressWarnings Java Annotation JDeveloper 12c now also “listens” to annotation and suppresses warnings itself (not only javac)
  • 27. JDeveloper 12c Suppression Scheme Why not create our own for non-Java (aka XML)?
  • 30.
  • 31.
  • 32. ADF EMG Audit Rules
  • 33.
  • 34.
  • 35.
  • 36.
  • 37. ADF Code Guidelines Extension ● JDeveloper extension available today ● ADF Code Guidelines auditing during development ● Community project at java.net: adfemg-auditrules ● Contribute and discuss at ADF EMG ● JDeveloper 12c & JDeveloper 11g
  • 39. OJAudit ● Command line auditing ● JDEV_HOME/jdev/bin/ojaudit -help ● Output in XML/text/HTML or custom xsl
  • 40.
  • 41. Automated QA ● Simple solution: Run ojaudit from CI server and publish output ● Benefit: Same rules during development and CI QA ● @SuppressWarnings and<!-- SuppressWarning--> keep list of violations short and actionable
  • 43.
  • 44. SonarQube ● Tool to manage Code Quality ● Rules, Violations, Metrics, Test Coverage, etc ● Free Open Source ● Initially Java, but now 20+ languages ● Historical data, thus trends ● Highly extensible through plugins
  • 45.
  • 46.
  • 47.
  • 48.
  • 49. ADF EMG SonarQube plugin ● SonarQube plugin o runs ojaudit o converts ojaudit output to SonarQube violations ● www.sonarqube.com for base product ● Watch ADF EMG for availability of plugin ● Not specific to ADF, but for any JDev project ● Tested with JDeveloper 12c, but should work with any version
  • 50. Summary ● Audit Profiles and Preferences ● Creating Custom Rules ● SuppressWarnings JDev Extension ● ADF EMG Audit Rules Extension ● SonarQube ojaudit plugin
  • 51. Further Reading ● www.olrichs.nl o Index page for Audit Rules ● www.redheap.com ● www.adfemg.org o Google Groups ● http://docs.oracle.comJDeveloper Doc (not ADF documentation) o Developing Extensions for JDeveloper o Java API Reference for Extension SDK

Editor's Notes

  1. Verschillende uitingen van (standaard) audit rules (het framework).
  2. Audit opties.
  3. Audit Profile, samenstellen, exporteren/importeren. Per rule configureren. New via save as.
  4. Style (weergave) / Severity (hoogte rapportage).Visibility voor java (niveau), default fix nog in te stellen als er meerdere fixen gedefinieerd zijn.
  5. Via Application overview ook een overzicht van rules te verkrijgen.
  6. Het overzicht, verschillende tabbladen voor verschillende soort files.
  7. De hele JWS auditen.
  8. De hele JWS auditen.
  9. Overzicht in een issue overzicht. Filter en groepeer mogelijkheden.
  10. Sync tussen extension.xml en manifest.mf