不同的Maven版本提供不同的Pmd结果

Question

One of my projects used the maven-pmd-plugin and I have found that I receive different results when using Maven 3.0.5 and Maven 3.2.1. All other variables (Java version, OS version, project configuration). I've also tried Maven 3.1.1

I'm running

mvn clean pmd:pmd

on the command line

In Maven 3.0.5, I get one warning:

<violation beginline="44" endline="307" begincolumn="8" endcolumn="1" rule="MoreThanOneLogger" ruleset="Java Logging" package="com.adobe.acs.commons.logging.impl" externalInfoUrl="${pmd.website.baseurl}/rules/java/logging-java.html#MoreThanOneLogger" priority="2">
Class contains more than one logger.
</violation>

In Maven 3.2.1 (and 3.1.1), I get zero warnings.

I also tried removing my custom rulset and now have the maven-pmd-plugin configured like this:

<plugin>
     <artifactId>maven-pmd-plugin</artifactId>
     <version>3.1</version>
     <configuration>
         <linkXRef>false</linkXRef>
         <rulesets>
             <ruleset>/rulesets/java/logging-java.xml</ruleset>
         </rulesets>
         <targetJdk>1.6</targetJdk>
     </configuration>
 </plugin>

With the same result.

Answer 1

Knowing the wider context of your issue helped me to arrive at the solution without too much discussion.

There is a difference in the graph of implicit dependencies between the various maven versions, as in the ones that come along with maven as baked in defaults. I am able to reproduce this issue locally, and when I add the -X switch for debug mode, and run a diff for mvn clean pmd:pmd pmd:check -X on both maven versions, I see the following import in the 3.2.1 output, which I thought was a possible candidate for follow-up, since it has to do not only with the kind of logging that the rule checks for, but also because I happen to know you are using slf4j:

[DEBUG] Imported: org.slf4j.* < plexus.core

It appears that SLF4j was added to plexus.core, which may mean that the slf4j api is available to all plugin classpaths now, whereas before it would require that the plugin imported the library in its own dependencies.

I went to see what the PMD MoreThanOneLoggerRule is looking up, and it turns out it only looks for Log4j loggers and JCL loggers by resolved type, and anything named "Logger" if it can't resolve the type:

http://pmd.sourceforge.net/pmd-5.1.1/xref/net/sourceforge/pmd/lang/java/rule/logging/MoreThanOneLoggerRule.html

The solution appears to be to add the slf4j API right in the pmd plugin dependencies, as in:

<plugin>
    <artifactId>maven-pmd-plugin</artifactId>
    <version>3.1</version>
    <configuration>
        <linkXRef>false</linkXRef>
        <rulesets>
            <ruleset>/rulesets/java/logging-java.xml</ruleset>
        </rulesets>
        <targetJdk>1.6</targetJdk>
    </configuration>
    <dependencies>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>1.6.4</version>
        </dependency>
    </dependencies>
</plugin>

This puts org.slf4j.Logger on the PMD classpath, so that it is able to resolve the type during analysis. Since it is neither a Log4j Logger or JCL Logger, it no longer cares about having more than one of them.