Abstract Static code analysis tools such as FindBugs and SonarQube are widely used on open-source and industrial projects to detect a variety of issues that may negatively affect the quality of software. Despite these tools’ popularity and high level of automation, several empirical studies report that developers normally fix only a small fraction (typically, less than 10% (Marcilio et al., 2019) of the reported issues—so-called “warnings”. If these analysis tools could also automatically provide suggestions on how to fix the issues that trigger some of the warnings, their feedback would become more actionable and more directly useful to developers. In this work, we investigate whether it is feasible to automatically generate fix suggestions for common warnings issued by static code analysis tools, and to what extent developers are willing to accept such suggestions into the codebases they are maintaining. To this end, we implemented SpongeBugs, a Java program transformation technique that fixes 11 distinct rules checked by two well-known static code analysis tools (SonarQube and SpotBugs). Fix suggestions are generated automatically based on templates, which are instantiated in a way that removes the source of the warnings; templates for some rules are even capable of producing multi-line patches. Based on the suggestions provided by SpongeBugs, we submitted 38 pull requests, including 946 fixes generated automatically by our technique for various open-source Java projects, including Eclipse UI—a core component of the Eclipse IDE—and both SonarQube and SpotBugs. Project maintainers accepted 87% of our fix suggestions (97% of them without any modifications). We further evaluated the applicability of our technique on software written by students and on a curated collection of bugs. All results indicate that our approach to generating fix suggestions is feasible, flexible, and can help increase the applicability of static code analysis tools.

中文翻译：

---

Spongebugs：自动生成修复建议以响应静态代码分析警告

摘要 FindBugs 和 SonarQube 等静态代码分析工具广泛用于开源和工业项目，以检测可能对软件质量产生负面影响的各种问题。尽管这些工具很受欢迎且自动化程度很高，但一些实证研究报告称，开发人员通常只修复一小部分（通常不到 10%（Marcilio 等，2019）报告的问题）——即所谓的“警告”。如果这些分析工具也能自动提供关于如何修复触发一些警告的问题的建议，他们的反馈将变得更具可操作性，对开发人员更直接有用。在这项工作中，我们调查自动生成修复建议是否可行对于静态代码分析工具发出的常见警告，以及开发人员在多大程度上愿意在他们维护的代码库中接受这些建议。为此，我们实施了 SpongeBugs，这是一种 Java 程序转换技术，可修复由两个著名的静态代码分析工具（SonarQube 和 SpotBugs）检查的 11 条不同规则。修复建议基于模板自动生成，以消除警告来源的方式实例化；某些规则的模板甚至能够生成多行补丁。根据 SpongeBugs 提供的建议，我们提交了 38 个拉取请求，其中包括我们的技术为各种开源 Java 项目自动生成的 946 个修复程序，包括 Eclipse UI（Eclipse IDE 的核心组件）以及 SonarQube 和 SpotBugs。项目维护者接受了我们 87% 的修复建议（其中 97% 没有任何修改）。我们进一步评估了我们的技术在学生编写的软件和精选的错误集合上的适用性。所有结果都表明我们生成修复建议的方法是可行的、灵活的，并且有助于提高静态代码分析工具的适用性。