[Error] Resource not found: java/lang/Object.class (Java 9)

[streichsbaer]

Hi,

I've downloaded the latest cli release findsecbugs-cli-1.7.1.zip and tried running it, but it throws the following error.

Exception in thread "main" java.io.IOException: IOException while scanning codebases
	at edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:285)
	at edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:393)
	at edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1200)
	at edu.umd.cs.findbugs.LaunchAppropriateUI.launch(LaunchAppropriateUI.java:106)
	at edu.umd.cs.findbugs.LaunchAppropriateUI.main(LaunchAppropriateUI.java:198)
Caused by: edu.umd.cs.findbugs.classfile.ResourceNotFoundException: Resource not found: java/lang/Object.class
	at edu.umd.cs.findbugs.classfile.impl.ClassPathImpl.lookupResource(ClassPathImpl.java:164)
	at edu.umd.cs.findbugs.classfile.impl.ClassPathBuilder.build(ClassPathBuilder.java:282)
	at edu.umd.cs.findbugs.FindBugs2.buildClassPath(FindBugs2.java:677)
	at edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:218)

I've tried it with Java 7, 8 and 9. Also, the release findsecbugs-cli-1.6.0.zip works flawlessly.

Cheers

[h3xstream]

Please provide a sample (java code or class file) to reproduce the bug.

[streichsbaer]

Oh, I omitted the first line, my apologies.

I just try to get the cli executed, without any arguments, which should default to printing the findsecbugs help.

./findsecbugs.sh

[h3xstream]

This is related to Java 9 JDK/JRE.

More information can be found here : spotbugs/spotbugs#148

The only good news is that I am able to reproduce.

(I have added --add-modules=ALL-SYSTEM to the java command and it does not seem to fix the issue.)

[streichsbaer]

I'm using the spotbugs binary release and just load findsecbugs as a plugin. This workaround is ok for me. Thanks

[h3xstream]

I'm taking @streichsbaer words.
More info : spotbugs/spotbugs#148