README.md
1## NullAway: Fast Annotation-Based Null Checking for Java [](https://github.com/uber/nullaway/actions/workflows/continuous-integration.yml) [](https://coveralls.io/github/uber/NullAway?branch=master)
2
3NullAway is a tool to help eliminate `NullPointerException`s (NPEs) in your Java code. To use NullAway, first add `@Nullable` annotations in your code wherever a field, method parameter, or return value may be `null`. Given these annotations, NullAway performs a series of type-based, local checks to ensure that any pointer that gets dereferenced in your code cannot be `null`. NullAway is similar to the type-based nullability checking in the Kotlin and Swift languages, and the [Checker Framework](https://checkerframework.org/) and [Eradicate](https://fbinfer.com/docs/checker-eradicate/) null checkers for Java.
4
5NullAway is *fast*. It is built as a plugin to [Error Prone](http://errorprone.info/) and can run on every single build of your code. In our measurements, the build-time overhead of running NullAway is usually less than 10%. NullAway is also *practical*: it does not prevent all possible NPEs in your code, but it catches most of the NPEs we have observed in production while imposing a reasonable annotation burden, giving a great "bang for your buck."
6
7## Installation
8
9### Overview
10
11NullAway requires that you build your code with [Error Prone](http://errorprone.info), version 2.4.0 or higher. See the [Error Prone documentation](http://errorprone.info/docs/installation) for instructions on getting started with Error Prone and integration with your build system. The instructions below assume you are using Gradle; see [the docs](https://github.com/uber/NullAway/wiki/Configuration#other-build-systems) for discussion of other build systems.
12
13### Gradle
14
15#### Java (non-Android)
16
17To integrate NullAway into your non-Android Java project, add the following to your `build.gradle` file:
18
19```gradle
20plugins {
21 // we assume you are already using the Java plugin
22 id "net.ltgt.errorprone" version "0.6"
23}
24
25dependencies {
26 annotationProcessor "com.uber.nullaway:nullaway:0.9.5"
27
28 // Optional, some source of nullability annotations.
29 // Not required on Android if you use the support
30 // library nullability annotations.
31 compileOnly "com.google.code.findbugs:jsr305:3.0.2"
32
33 errorprone "com.google.errorprone:error_prone_core:2.4.0"
34 errorproneJavac "com.google.errorprone:javac:9+181-r4173-1"
35}
36
37import net.ltgt.gradle.errorprone.CheckSeverity
38
39tasks.withType(JavaCompile) {
40 // remove the if condition if you want to run NullAway on test code
41 if (!name.toLowerCase().contains("test")) {
42 options.errorprone {
43 check("NullAway", CheckSeverity.ERROR)
44 option("NullAway:AnnotatedPackages", "com.uber")
45 }
46 }
47}
48```
49
50Let's walk through this script step by step. The `plugins` section pulls in the [Gradle Error Prone plugin](https://github.com/tbroyer/gradle-errorprone-plugin) for Error Prone integration. If you are using the older `apply plugin` syntax instead of a `plugins` block, the following is equivalent:
51```gradle
52buildscript {
53 repositories {
54 gradlePluginPortal()
55 }
56 dependencies {
57 classpath "net.ltgt.gradle:gradle-errorprone-plugin:0.6"
58 }
59}
60
61apply plugin: 'net.ltgt.errorprone'
62```
63
64In `dependencies`, the `annotationProcessor` line loads NullAway, and the `compileOnly` line loads a [JSR 305](https://jcp.org/en/jsr/detail?id=305) library which provides a suitable `@Nullable` annotation (`javax.annotation.Nullable`). NullAway allows for any `@Nullable` annotation to be used, so, e.g., `@Nullable` from the Android Support Library or JetBrains annotations is also fine. The `errorprone` line ensures that a compatible version of Error Prone is used, and the `errorproneJavac` line is needed for JDK 8 compatibility.
65
66Finally, in the `tasks.withType(JavaCompile)` section, we pass some configuration options to NullAway. First `check("NullAway", CheckSeverity.ERROR)` sets NullAway issues to the error level (it's equivalent to the `-Xep:NullAway:ERROR` standard Error Prone argument); by default NullAway emits warnings. Then, `option("NullAway:AnnotatedPackages", "com.uber")` (equivalent to the `-XepOpt:NullAway:AnnotatedPackages=com.uber` standard Error Prone argument), tells NullAway that source code in packages under the `com.uber` namespace should be checked for null dereferences and proper usage of `@Nullable` annotations, and that class files in these packages should be assumed to have correct usage of `@Nullable` (see [the docs](https://github.com/uber/NullAway/wiki/Configuration) for more detail). NullAway requires at least the `AnnotatedPackages` configuration argument to run, in order to distinguish between annotated and unannotated code. See [the configuration docs](https://github.com/uber/NullAway/wiki/Configuration) for other useful configuration options.
67
68We recommend addressing all the issues that Error Prone reports, particularly those reported as errors (rather than warnings). But, if you'd like to try out NullAway without running other Error Prone checks, you can use `options.errorprone.disableAllChecks` (equivalent to passing `"-XepDisableAllChecks"` to the compiler, before the NullAway-specific arguments).
69
70Snapshots of the development version are available in [Sonatype's snapshots repository][snapshots].
71
72#### Android
73
74The configuration for an Android project is very similar to the Java case, with one key difference: The `com.google.code.findbugs:jsr305:3.0.2` dependency can be removed; you can use the `android.support.annotation.Nullable` annotation from the Android Support library.
75
76```gradle
77dependencies {
78 annotationProcessor "com.uber.nullaway:nullaway:0.9.5"
79 errorprone "com.google.errorprone:error_prone_core:2.4.0"
80 errorproneJavac "com.google.errorprone:javac:9+181-r4173-1"
81}
82```
83A complete Android `build.gradle` example is [here](https://gist.github.com/msridhar/6cacd429567f1d1ad9a278e06809601c). Also see our [sample app](https://github.com/uber/NullAway/blob/master/sample-app/). (The sample app's [`build.gradle`](https://github.com/uber/NullAway/blob/master/sample-app/) is not suitable for direct copy-pasting, as some configuration is inherited from the top-level `build.gradle`.)
84
85#### Annotation Processors / Generated Code
86
87Some annotation processors like [Dagger](https://google.github.io/dagger/) and [AutoValue](https://github.com/google/auto/tree/master/value) generate code into the same package namespace as your own code. This can cause problems when setting NullAway to the `ERROR` level as suggested above, since errors in this generated code will block the build. Currently the best solution to this problem is to completely disable Error Prone on generated code, using the `-XepExcludedPaths` option added in Error Prone 2.13 (documented [here](http://errorprone.info/docs/flags), use `options.errorprone.excludedPaths=` in Gradle). To use, figure out which directory contains the generated code, and add that directory to the excluded path regex.
88
89**Note for Dagger users**: Dagger versions older than 2.12 can have bad interactions with NullAway; see [here](https://github.com/uber/NullAway/issues/48#issuecomment-340018409). Please update to Dagger 2.12 to fix the problem.
90
91#### Lombok
92
93Unlike other annotation processors above, Lombok modifies the in-memory AST of the code it processes, which is the source of numerous incompatibilities with Error Prone and, consequently, NullAway.
94
95We do not particularly recommend using NullAway with Lombok. However, NullAway encodes some knowledge of common Lombok annotations and we do try for best-effort compatibility. In particular, common usages like `@lombok.Builder` and `@Data` classes should be supported.
96
97In order for NullAway to successfully detect Lombok generated code within the in-memory Java AST, the following configuration option must be passed to Lombok as part of an applicable `lombok.config` file:
98
99```
100addLombokGeneratedAnnotation
101```
102
103This causes Lombok to add `@lombok.Generated` to the methods/classes it generates. NullAway will ignore (i.e. not check) the implementation of this generated code, treating it as unannotated.
104
105## Code Example
106
107Let's see how NullAway works on a simple code example:
108```java
109static void log(Object x) {
110 System.out.println(x.toString());
111}
112static void foo() {
113 log(null);
114}
115```
116This code is buggy: when `foo()` is called, the subsequent call to `log()` will fail with an NPE. You can see this error in the NullAway sample app by running:
117```bash
118cp sample/src/main/java/com/uber/mylib/MyClass.java.buggy sample/src/main/java/com/uber/mylib/MyClass.java
119./gradlew build
120```
121
122By default, NullAway assumes every method parameter, return value, and field is _non-null_, i.e., it can never be assigned a `null` value. In the above code, the `x` parameter of `log()` is assumed to be non-null. So, NullAway reports the following error:
123```
124warning: [NullAway] passing @Nullable parameter 'null' where @NonNull is required
125 log(null);
126 ^
127```
128We can fix this error by allowing `null` to be passed to `log()`, with a `@Nullable` annotation:
129```java
130static void log(@Nullable Object x) {
131 System.out.println(x.toString());
132}
133```
134With this annotation, NullAway points out the possible null dereference:
135```
136warning: [NullAway] dereferenced expression x is @Nullable
137 System.out.println(x.toString());
138 ^
139```
140We can fix this warning by adding a null check:
141```java
142static void log(@Nullable Object x) {
143 if (x != null) {
144 System.out.println(x.toString());
145 }
146}
147```
148With this change, all the NullAway warnings are fixed.
149
150For more details on NullAway's checks, error messages, and limitations, see [our detailed guide](https://github.com/uber/NullAway/wiki).
151
152## Support
153
154Please feel free to [open a GitHub issue](https://github.com/uber/NullAway/issues) if you have any questions on how to use NullAway. Or, you can [join the NullAway Discord server](https://discord.gg/QH2F779) and ask us a question there.
155
156## Contributors
157
158We'd love for you to contribute to NullAway! Please note that once
159you create a pull request, you will be asked to sign our [Uber Contributor License Agreement](https://docs.google.com/a/uber.com/forms/d/1pAwS_-dA1KhPlfxzYLBqK6rsSWwRwH95OCCZrcsY5rk/viewform).
160
161## License
162
163NullAway is licensed under the MIT license. See the LICENSE.txt file for more information.
164
165 [snapshots]: https://oss.sonatype.org/content/repositories/snapshots/com/uber/nullaway/
166
){kind=link}
){kind=link}