Using PVS-Studio with IntelliJ IDEA and Android Studio

• Installing the plugin from the official JetBrains repository
• Installing the plugin from the PVS-Studio repository
• Installing the plugin via the PVS-Studio installer
  • Windows
  • Linux
• Plugin settings
  • How to change the Java version to run the analyzer
• Checking code from IntelliJ IDEA and Android Studio using PVS-Studio
• Managing analysis results
  • Viewing the most interesting analyzer warnings
  • Managing false positives
  • Suppressing analyzer warnings in legacy code
  • Dropdown menu of the warning table
  • Saving and loading analysis results
  • Keyboard shortcuts in PVS-Studio for IntelliJ IDEA and Android Studio
• PVS-Studio Java update
  • Using proxy

This documentation page covers the use of PVS-Studio analyzer with IntelliJ IDEA and Android Studio. To analyze projects and individual files, use PVS-Studio plugin that provides a convenient GUI. The plugin also helps manage analyzer warnings.

Download and install PVS-Studio plugins for IntelliJ IDEA and Android Studio from the official JetBrains plugin repository or from the repository on our website. You can also use the PVS-Studio installer, which is available on our download page.

Installing the plugin from the official JetBrains repository

To install PVS-Studio plugin from the official JetBrains repository, open the settings window by selecting File > Settings > Plugins. Then, select the Marketplace tab and enter PVS-Studio in the search bar. PVS-Studio plugin appears in the search results:

Click Install next to the plugin name. After the installation, click Restart IDE.

After restarting the IDE, PVS-Studio plugin is ready to analyze your code.

Note. There is no need to download and install the Java analyzer core separately. The plugin downloads and installs the necessary core version when you run the analysis in IntelliJ IDEA or Android Studio.

Installing the plugin from the PVS-Studio repository

In addition to the official JetBrains repository, PVS-Studio plugin is also available in the PVS-Studio repository. To install the plugin from there, add this repository to the IDE. To do this, click File > Settings > Plugins to open the plugin installation window, click the gear icon in the top-right corner, and select Manage Plugin Repositories from the drop-down menu:

Enter the path https://files.pvs-studio.com/java/pvsstudio-idea-plugins/updatePlugins.xml and click OK.

The last installation step is the same as in the previous scenario of installing the plugin from the official repository. Open the Marketplace tab and enter PVS-Studio in the search bar. Select PVS-Studio for IDEA and Android Studio plugin in the search results, click Install, and restart the IDE.

Installing the plugin via the PVS-Studio installer

Windows

To install PVS‑Studio plugin on Windows, close all running IntelliJ IDEA instances, select your IDE in the installer menu, and complete the installation.

Linux

On Linux, PVS‑Studio plugin for IntelliJ IDEA is bundled with the Java analyzer archive.

To install the plugin, open the Plugins section in the IDE settings.

Click the gear icon and select Install Plugin from Disk.

Specify the path to the .zip archive containing the plugin. After that, the plugin will be successfully installed.

Plugin settings

The Settings window of PVS-Studio plugin has multiple tabs.

Settings contains settings of the PVS-Studio analyzer core. Hover the cursor over the setting name to see a pop-up tooltip for it. The Environment subsection contains settings that the plugin uses to run the Java analyzer core (the pvs-studio.jar JVM process). The default values of these settings are taken from the global.json file. If you change the settings in this tab, they will be saved in a separate file. This file overrides the settings from global.json when running the analysis. The changed settings do not affect the global.json file contents:

Warnings contains a list of all diagnostic rules supported by the analyzer. If you uncheck diagnostic rules, all warnings of the chosen type will be filtered out of the analyzer output window. During the next analysis run, the corresponding diagnostic rule will be disabled (it will not issue any warnings):

Excludes contains paths for files and directories that should be excluded from the analysis. You can set either an absolute path or a path relative to the root directory of the project:

API Compatibility Issue Detection contains settings for the V6078 diagnostic rule (disabled by default). This diagnostic rule helps determine whether the API JDK used in your project will change or disappear in one of the upcoming JDK versions:

Registration displays information about the current PVS-Studio license in the system. You can also edit the information in this tab and ensure that the entered license is valid.

How to change the Java version to run the analyzer

By default, the analyzer runs the core using the java file from the PATH environment variable. To run the analysis with some other version, you can manually specify it. To do this, open the Environment subsection in the Settings tab of the plugin and enter the path to the java file from the required JDK in the Java executable field. The analyzer will use the selected JDK version (the version of the Java language) during the analysis of project source code:

Checking code from IntelliJ IDEA and Android Studio using PVS-Studio

Before running the analysis, enter the license. To learn how to do this, please see the documentation.

You can check:

• a current project;
• items selected in the Project window;
• a file currently opened in an IDE.

Note. when analyzing a project, the plugin starts the Java analyzer core. When the analyzer core is started, it uses the same Java language version as the JDK. The java file from the JDK is used to start the Java analyzer core (the Java executable field on the Settings tab of the plugin settings). If you want to change the Java language version to be used in the analysis, use the java file from the JDK for that version to run the Java analyzer core.

To analyze the current project, you can use Tools > PVS-Studio > Check Project.

To check a currently opened file, you can use:

• the Tools > PVS-Studio > Check Current File menu item;
• the context menu item of the file;
• the context menu item of the file header in the file editor.

You can also select several items in the Explorer window by holding down CTRL/SHIFT + Left Mouse Click. Then, choose the Analyze with PVS-Studio menu item:

The following files are analyzed in the examples above:

• the *.java files (from the com.pvsstudio.formats package);
• the JsonEvaluator file (from the com.pvsstudio.projects package);
• the Main file (from the com.pvsstudio package);
• the Box file from the common module (from the com.pvsstudio package).

Managing analysis results

The analysis results issued by PVS-Studio analyzer are displayed in a table within the PVS-Studio window:

The table consists of 7 columns, arranged from left to right as follows: Favorite, Code, CWE, SAST, Message, Position, and False Alarms. You can sort the analyzer messages by any column. To change the sorting order, click the column heading. The Favorite column on the far left is used to mark warnings. If you enable sorting by the Favorite column, you can quickly find all marked warnings.

Clicking a warning in the Code/CWE columns opens a webpage in your browser, providing a detailed description of the warning or potential vulnerability. The SAST column indicates the OWASP ASVS code vulnerability identifier for the warning. The Message column gives short descriptions of the warnings. The Position column contains a list of files the warning refers to. The False Alarms column displays warnings marked as false positives. You can find more details on managing false positives in the relevant section.

Double-click a warning in the table to open the file at the line that triggered the analyzer:

There are also two arrow buttons above the table. You can use them to move between the warnings and open the needed files in the source code editor. To the right of the arrow buttons, you can set filters by the warning level: High, Medium, and Low. The Fails filter contains errors of the analyzer.

When you click the search button, an additional panel opens with text fields to search across the Code, CWE, SAST, Message, and Position columns. Each field is a string filter for a column that enables the sorting of messages in the table by the text entered in the fields:

Click a hamburger button in the top-left corner above the table to open an additional settings panel:

Click the gear icon to open the plugin settings main window, or click Tools > PVS-Studio > Settings.

Viewing the most interesting analyzer warnings

If you are new to the static analysis tool and would like to learn about its capabilities, you can use the Best Warnings mechanism. It displays the most important and reliable warnings.

To view the most interesting analyzer warnings, click the Best button, as shown in the screenshot below:

When the analysis is complete, the result table will display a list of ten most critical warnings.

Managing false positives

In some cases, the analyzer may issue a warning for a section of code that does not contain any errors. Such a warning is called a false positive.

PVS-Studio plugin allows you to mark the analyzer messages as false positives to prevent them from appearing in future checks.

To mark false positives, select one or more warnings in the PVS-Studio table, right-click any row to open the dropdown menu, and select the Mark Selected Messages As False Alarms menu item:

The analyzer will add the special \\-Vxxxx comment (xxxx is the PVS-Studio diagnostic rule number) to the line where the analyzer issues a warning. You can also add such comments manually.

To display warnings previously marked as false positives in the table, click Tools > PVS-Studio > Settings and enable Show False Alarms:

Use the Remove False Alarm marks from selected messages menu item in the dropdown menu to unmark selected warnings as false positives.

To learn more how to suppress warnings issued by the analyzer and other ways of suppressing warnings, see the Suppression of False Alarms documentation section.

Suppressing analyzer warnings in legacy code

Warnings issued for legacy code often interfere with regular static analysis and the viewing of warnings for new or under-development code.

To resolve this issue, PVS-Studio analyzer has a feature disable warnings for old code. To do this, you can use the Suppress All Messages button on the PVS-Studio window panel. The suppression mechanism uses a special suppression file. Suppressed analyzer warnings are added to the file after the Suppress All Messages command is executed. During the next analysis run, any messages added to the suppression file will be excluded from the report.

In the IDEA, suppressed warnings are added to the suppress_base.json file. This file is written to the .PVS-Studio directory in the root directory of a project in the IDEA. To restore these warnings in the analyzer report, delete the suppress files linked to the affected projects and restart the analysis.

To learn more about warning suppression and how to handle the suppress files, see the Baselining analysis results documentation section.

You can also read the article "How to introduce a static code analyzer in a legacy project and not to discourage the team".

Dropdown menu of the warning table

To manage selected warnings, right-click a warning in the PVS-Studio window table to open a dropdown menu with additional items.

The Copy Selected Messages To Clipboard menu item copies all selected warnings in the window with PVS-Studio plugin report to the clipboard.

The Mark Selected Messages As Important menu item allows to mark a warning with an asterisk, which helps easily find it when sorting by the Favorite column (the leftmost column).

Click the Mark selected messages as False Alarms / Remove false alarm masks menu item to mark selected warnings as false positives by adding a special comment to the code lines they refer to (see the above section on managing false positives).

The Add Selected Messages To Suppression File menu item enables the suppression of the warnings selected in the tab that shows the PVS-Studio plugin report. During the next analysis run, these warnings will not be displayed in the window.

The Hide All V5319 Errors menu item hides all warnings that have this number.

The Exclude from analysis menu item allows to add a full or partial path name to the file that contains a warning to the list of directories excluded from the analysis. Any file whose path name matches the filter will be excluded from the analysis.

The Show Columns menu item opens a list with column names that you can display or hide.

Saving and loading analysis results

Click Tools > PVS-Studio to save or load results:

The Open Report menu item opens the .json report file and loads its contents into the table in the PVS-Studio output window.

The Recent Reports submenu contains a list of recently opened reports. Click an item in this list to open the report file (if the file still exists at that path) and load its contents to the table in the PVS-Studio window.

Select the Save Report menu item to save all the messages from the table (even the filtered ones) to a .json report file. If the current list of messages has never been saved before, you will be prompted to enter a name for the report and choose where to save it.

Similarly, selecting the Save Report As menu item saves all warnings from the table (including the filtered ones) to the .json file and always prompts you to specify the location where to save the report.

The Export Report To... menu item allows to save the analyzer report in different formats (.xml, .txt, .tasks, .pvslog, .log, .html, and .err). Each format is useful for different cases and utilities.

The Export Report To HTML... menu item allows to save the analyzer report to a selected folder in HTML format. You can view warnings and navigate through the source code files directly in the browser. This command creates a folder named fullhtml containing the analyzer report file (index.html) in the selected folder.

Note. Instead of the Export Report To HTML... command, it is better to use the PlogConverter (Windows) and plog-converter (Linux and macOS) console utilities. They enable you to convert the analyzer report to more formats (for example, SARIF). The utilities provide additional features: filtering warnings from the report, converting paths in the report from absolute to relative (and vice versa), getting data on the differences between reports, etc.

Keyboard shortcuts in PVS-Studio for IntelliJ IDEA and Android Studio

PVS-Studio plugin for IntelliJ IDEA and Android Studio adds a dedicated window for viewing PVS-Studio analysis results. It has a dropdown menu that appears when you right-click the analysis result window:

Some of the actions have keyboard shortcuts. Thus, you can perform them without using a mouse.

The arrow keys for navigating the analyzer warnings also have shortcuts:

• move to the next message: Alt + [;
• move to the previous message: Alt + ].

Using shortcuts is helpful, since they speed up the analysis result processing. You can set and customize the shortcuts in the settings: File > Settings > Keymap. To find shortcuts faster, enter PVS-Studio in the search bar of the Keymap window.

PVS-Studio Java update

If the PVS-Studio update is available, you will get a message in the analysis report.

To update the plugin, open File > Settings > Plugins, find the PVS-Studio for IDEA and Android Studio plugin in the Installed list, click Update, and restart the IDE.

Using proxy

Use proxy to download the ZIP archive for Java on the Download page. The archive contains the Java analyzer core (the 7.39.99802 folder in the pvs-studio-java directory). Unpack the Java analyzer core to the standard installation path for the analyzer Java core:

• Windows: %APPDATA%/PVS-Studio-Java;
• Linux and macOS: ~/.config/PVS-Studio-Java.

As a result, the version-named folder (copied from the archive) should be located in the standard installation path of the analyzer Java core.