data: demo-pmd 每文件审核报告入库（26 份，绝对路径规范化）

data/demo-pmd/reports/MultiPerfSecurity-review.md

@@ -0,0 +1,398 @@
+# 代码审查报告
+
+**文件:** `data\demo-pmd\src\com\demo\mtps\MultiPerfSecurity.java`
+**语言:** java
+**耗时:** 301.2s
+**分析工具:** pmd
+
+> ⚠️ 部分 AI 功能不可用，报告已降级
+
+## 错误
+- AI 审查请求失败: AbortError: This operation was aborted
+
+---
+
+总计: 190 | 错误: 7 | 警告: 175 | 建议: 8
+
+静态分析 · 190 个问题
+
+- 🔴 `pmd:DoubleCheckedLocking` L58
+  Double checked locking is not thread safe in Java.
+- 🔴 `pmd:FieldNamingConventions` L111
+  The constant name 'sdf' doesn't match '[A-Z][A-Z_0-9]*'
+- 🔴 `pmd:AvoidFileStream` L157
+  Avoid instantiating FileInputStream, FileOutputStream, FileReader, or FileWriter
+- 🔴 `pmd:StringInstantiation` L232
+  Avoid instantiating String objects; this is usually unnecessary.
+- 🔴 `pmd:AvoidReassigningParameters` L268
+  Avoid reassigning parameters such as 's'
+- 🔴 `pmd:SystemPrintln` L300
+  Usage of System.out/err
+- 🔴 `pmd:SystemPrintln` L382
+  Usage of System.out/err
+- 🟡 `pmd:AtLeastOneConstructor` L31
+  Each class should declare at least one constructor
+- 🟡 `pmd:UnusedPrivateField` L32
+  Avoid unused private fields such as 'count'.
+- 🟡 `pmd:PublicMemberInNonPublicType` L33
+  Public member 'incr' declared in a non-public type
+- 🟡 `pmd:AvoidSynchronizedAtMethodLevel` L33
+  Use block level locking rather than method level synchronization
+- 🟡 `pmd:AtLeastOneConstructor` L39
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L40
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:LocalVariableCouldBeFinal` L41
+  Local variable 'g' could be declared final
+- 🟡 `pmd:AvoidThreadGroup` L41
+  Avoid using java.lang.ThreadGroup; it is not thread safe
+- 🟡 `pmd:UnusedLocalVariable` L42
+  Avoid unused local variables such as 't'.
+- 🟡 `pmd:AtLeastOneConstructor` L47
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L48
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:LocalVariableCouldBeFinal` L49
+  Local variable 't' could be declared final
+- 🟡 `pmd:UseUtilityClass` L55
+  All members are static. Consider adding a private no-args constructor to prevent instantiation.
+- 🟡 `pmd:CommentDefaultAccessModifier` L58
+  Missing commented default access modifier on method 'get()'
+- 🟡 `pmd:UseUtilityClass` L71
+  All members are static. Consider adding a private no-args constructor to prevent instantiation.
+- 🟡 `pmd:CommentDefaultAccessModifier` L74
+  Missing commented default access modifier on method 'get()'
+- 🟡 `pmd:NonThreadSafeSingleton` L75
+  Singleton is not thread safe
+- 🟡 `pmd:AtLeastOneConstructor` L83
+  Each class should declare at least one constructor
+- 🟡 `pmd:OverridingThreadRun` L85
+  Don't override Thread.run() method, use Runnable instead
+- 🟡 `pmd:UnusedPrivateField` L91
+  Avoid unused private fields such as 'SDF'.
+- 🟡 `pmd:SimpleDateFormatNeedsLocale` L91
+  When instantiating a SimpleDateFormat object, specify a Locale
+- 🟡 `pmd:AtLeastOneConstructor` L95
+  Each class should declare at least one constructor
+- 🟡 `pmd:UseConcurrentHashMap` L96
+  If you run in Java5 or newer and have concurrent access, you should use the ConcurrentHashMap implementation
+- 🟡 `pmd:CommentDefaultAccessModifier` L96
+  Missing commented default access modifier on field 'map'
+- 🟡 `pmd:AtLeastOneConstructor` L100
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L101
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:LocalVariableCouldBeFinal` L102
+  Local variable 'lock' could be declared final
+- 🟡 `pmd:UseNotifyAllInsteadOfNotify` L104
+  Call Thread.notifyAll() rather than Thread.notify()
+- 🟡 `pmd:AtLeastOneConstructor` L110
+  Each class should declare at least one constructor
+- 🟡 `pmd:SimpleDateFormatNeedsLocale` L111
+  When instantiating a SimpleDateFormat object, specify a Locale
+- 🟡 `pmd:CommentDefaultAccessModifier` L113
+  Missing commented default access modifier on method 'bar()'
+- 🟡 `pmd:UnsynchronizedStaticFormatter` L114
+  Static Formatter objects should be accessed in a synchronized manner
+- 🟡 `pmd:ReplaceJavaUtilDate` L114
+  Usage of java.util.Date should be replaced with classes from java.time
+- 🟡 `pmd:AtLeastOneConstructor` L123
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L124
+  Missing commented default access modifier on method 'bad(int)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L124
+  Parameter 'x' is not assigned and could be declared final
+- 🟡 `pmd:AddEmptyString` L125
+  Do not add empty strings
+- 🟡 `pmd:AtLeastOneConstructor` L130
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L131
+  Missing commented default access modifier on method 'bad(StringBuffer)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L131
+  Parameter 'sb' is not assigned and could be declared final
+- 🟡 `pmd:AppendCharacterWithChar` L132
+  Avoid appending characters as strings in StringBuffer.append.
+- 🟡 `pmd:AtLeastOneConstructor` L137
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L138
+  Missing commented default access modifier on method 'bad(int[], int[])'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L138
+  Parameter 'src' is not assigned and could be declared final
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L138
+  Parameter 'dst' is not assigned and could be declared final
+- 🟡 `pmd:AvoidArrayLoops` L139
+  Arrays.copyOf or System.arraycopy are more efficient
+- 🟡 `pmd:AtLeastOneConstructor` L146
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L147
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:LocalVariableCouldBeFinal` L148
+  Local variable 'c' could be declared final
+- 🟡 `pmd:ReplaceJavaUtilCalendar` L148
+  Usage of java.util.Calendar should be replaced with classes from java.time
+- 🟡 `pmd:UselessPureMethodCall` L150
+  Do not call pure method getTime if the result is not used.
+- 🟡 `pmd:AtLeastOneConstructor` L155
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L156
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:CloseResource` L157
+  Ensure that resources like this FileInputStream object are closed after use
+- 🟡 `pmd:LocalVariableCouldBeFinal` L157
+  Local variable 'fis' could be declared final
+- 🟡 `pmd:AtLeastOneConstructor` L164
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L165
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:UnusedLocalVariable` L167
+  Avoid unused local variables such as 'o'.
+- 🟡 `pmd:AvoidInstantiatingObjectsInLoops` L167
+  Avoid instantiating new objects inside loops
+- 🟡 `pmd:AtLeastOneConstructor` L173
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L174
+  Missing commented default access modifier on field 'b'
+- 🟡 `pmd:BigIntegerInstantiation` L174
+  Don't create instances of already existing BigInteger and BigDecimal (ZERO, ONE, TEN)
+- 🟡 `pmd:AtLeastOneConstructor` L178
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L179
+  Missing commented default access modifier on method 'bad(StringBuilder)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L179
+  Parameter 'sb' is not assigned and could be declared final
+- 🟡 `pmd:ConsecutiveAppendsShouldReuse` L180
+  StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.
+- 🟡 `pmd:ConsecutiveLiteralAppends` L180
+  StringBuffer (or StringBuilder).append is called 3 consecutive times with literals. Use a single append with a single combined String.
+- 🟡 `pmd:ConsecutiveAppendsShouldReuse` L181
+  StringBuffer (or StringBuilder).append is called consecutively without reusing the target variable.
+- 🟡 `pmd:AppendCharacterWithChar` L181
+  Avoid appending characters as strings in StringBuffer.append.
+- 🟡 `pmd:AtLeastOneConstructor` L187
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L188
+  Missing commented default access modifier on method 'bad(StringBuilder)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L188
+  Parameter 'sb' is not assigned and could be declared final
+- 🟡 `pmd:AtLeastOneConstructor` L194
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L195
+  Missing commented default access modifier on method 'bad(String)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L195
+  Parameter 's' is not assigned and could be declared final
+- 🟡 `pmd:LiteralsFirstInComparisons` L196
+  Position literals first in String comparisons
+- 🟡 `pmd:AtLeastOneConstructor` L201
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L202
+  Missing commented default access modifier on method 'bad(int, int)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L202
+  Parameter 'a' is not assigned and could be declared final
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L202
+  Parameter 'b' is not assigned and could be declared final
+- 🟡 `pmd:VariableCanBeInlined` L203
+  Consider simply using the value vs. storing it in local variable 's'.
+- 🟡 `pmd:LocalVariableCouldBeFinal` L203
+  Local variable 's' could be declared final
+- 🟡 `pmd:AtLeastOneConstructor` L209
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L210
+  Missing commented default access modifier on method 'bad(String)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L210
+  Parameter 's' is not assigned and could be declared final
+- 🟡 `pmd:LocalVariableCouldBeFinal` L211
+  Local variable 'sb' could be declared final
+- 🟡 `pmd:AtLeastOneConstructor` L217
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L218
+  Missing commented default access modifier on method 'bad(List<String>)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L218
+  Parameter 'l' is not assigned and could be declared final
+- 🟡 `pmd:UnusedLocalVariable` L219
+  Avoid unused local variables such as 'arr'.
+- 🟡 `pmd:OptimizableToArrayCall` L219
+  This call to Collection.toArray() may be optimizable
+- 🟡 `pmd:AtLeastOneConstructor` L224
+  Each class should declare at least one constructor
+- 🟡 `pmd:RedundantFieldInitializer` L225
+  Avoid using redundant field initializer for 'x'
+- 🟡 `pmd:CommentDefaultAccessModifier` L225
+  Missing commented default access modifier on field 'x'
+- 🟡 `pmd:RedundantFieldInitializer` L226
+  Avoid using redundant field initializer for 'b'
+- 🟡 `pmd:CommentDefaultAccessModifier` L226
+  Missing commented default access modifier on field 'b'
+- 🟡 `pmd:AtLeastOneConstructor` L230
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L231
+  Missing commented default access modifier on method 'bad(String)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L231
+  Parameter 's' is not assigned and could be declared final
+- 🟡 `pmd:UnusedLocalVariable` L232
+  Avoid unused local variables such as 't'.
+- 🟡 `pmd:AtLeastOneConstructor` L237
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L238
+  Missing commented default access modifier on method 'bad(String)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L238
+  Parameter 's' is not assigned and could be declared final
+- 🟡 `pmd:UnusedLocalVariable` L239
+  Avoid unused local variables such as 't'.
+- 🟡 `pmd:StringToString` L239
+  Avoid calling toString() on String objects; this is unnecessary.
+- 🟡 `pmd:AtLeastOneConstructor` L244
+  Each class should declare at least one constructor
+- 🟡 `pmd:LooseCoupling` L245
+  Avoid using implementation types like 'Vector'; use the interface instead
+- 🟡 `pmd:ReplaceVectorWithList` L245
+  Consider replacing this Vector with the newer java.util.List
+- 🟡 `pmd:CommentDefaultAccessModifier` L245
+  Missing commented default access modifier on field 'v'
+- 🟡 `pmd:ReplaceVectorWithList` L245
+  Consider replacing this Vector with the newer java.util.List
+- 🟡 `pmd:UseArrayListInsteadOfVector` L245
+  Use ArrayList instead of Vector
+- 🟡 `pmd:AtLeastOneConstructor` L249
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L250
+  Missing commented default access modifier on method 'bad(String[])'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L250
+  Parameter 'arr' is not assigned and could be declared final
+- 🟡 `pmd:LocalVariableCouldBeFinal` L251
+  Local variable 'l' could be declared final
+- 🟡 `pmd:LocalVariableCouldBeFinal` L252
+  Local variable 's' could be declared final
+- 🟡 `pmd:UseArraysAsList` L253
+  Use asList instead of tight loops
+- 🟡 `pmd:AtLeastOneConstructor` L259
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L260
+  Missing commented default access modifier on method 'bad(String)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L260
+  Parameter 's' is not assigned and could be declared final
+- 🟡 `pmd:UseIndexOfChar` L261
+  String.indexOf(char) is faster than String.indexOf(String).
+- 🟡 `pmd:AtLeastOneConstructor` L266
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L267
+  Missing commented default access modifier on method 'bad(String)'
+- 🟡 `pmd:UnusedAssignment` L268
+  The value assigned to variable 's' is never used
+- 🟡 `pmd:AtLeastOneConstructor` L273
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L274
+  Missing commented default access modifier on method 'bad(StringBuffer)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L274
+  Parameter 'sb' is not assigned and could be declared final
+- 🟡 `pmd:UseStringBufferLength` L275
+  This is an inefficient use of CharSequence.toString; call CharSequence.length instead.
+- 🟡 `pmd:AtLeastOneConstructor` L280
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L281
+  Missing commented default access modifier on method 'bad(String)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L281
+  Parameter 's' is not assigned and could be declared final
+- 🟡 `pmd:AtLeastOneConstructor` L287
+  Each class should declare at least one constructor
+- 🟡 `pmd:UnusedPrivateMethod` L288
+  Avoid unused private methods such as 'bad1()'.
+- 🟡 `pmd:AvoidCalendarDateCreation` L289
+  A Calendar is used to get the current time, this is expensive.
+- 🟡 `pmd:UnusedPrivateMethod` L291
+  Avoid unused private methods such as 'bad2()'.
+- 🟡 `pmd:AvoidCalendarDateCreation` L292
+  A Calendar is used to get the current time, this is expensive.
+- 🟡 `pmd:AtLeastOneConstructor` L297
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L298
+  Missing commented default access modifier on method 'bar(String)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L298
+  Parameter 'string' is not assigned and could be declared final
+- 🟡 `pmd:InefficientEmptyStringCheck` L299
+  String.trim().length() == 0 / String.trim().isEmpty() is an inefficient way to validate a blank String.
+- 🟡 `pmd:AtLeastOneConstructor` L306
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L307
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:LocalVariableCouldBeFinal` L308
+  Local variable 'sb' could be declared final
+- 🟡 `pmd:InefficientStringBuffering` L308
+  Avoid concatenating nonliterals in a StringBuffer/StringBuilder constructor or append().
+- 🟡 `pmd:AtLeastOneConstructor` L314
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L315
+  Missing commented default access modifier on method 'bad(String)'
+- 🟡 `pmd:LocalVariableCouldBeFinal` L316
+  Local variable 'sb' could be declared final
+- 🟡 `pmd:InsufficientStringBufferDeclaration` L316
+  StringBuilder has been initialized with size 16, but has at least 64 characters appended.
+- 🟡 `pmd:AtLeastOneConstructor` L323
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L324
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:UseStringBufferForStringAppends` L327
+  Prefer StringBuilder (non-synchronized) or StringBuffer (synchronized) over += for concatenating strings
+- 🟡 `pmd:CommentDefaultAccessModifier` L331
+  Missing commented default access modifier on method 'getString(int)'
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L331
+  Parameter 'i' is not assigned and could be declared final
+- 🟡 `pmd:AtLeastOneConstructor` L337
+  Each class should declare at least one constructor
+- 🟡 `pmd:PublicMemberInNonPublicType` L338
+  Public member 'convert' declared in a non-public type
+- 🟡 `pmd:MethodArgumentCouldBeFinal` L338
+  Parameter 'i' is not assigned and could be declared final
+- 🟡 `pmd:LocalVariableCouldBeFinal` L339
+  Local variable 's' could be declared final
+- 🟡 `pmd:UselessStringValueOf` L340
+  No need to call String.valueOf to append to a string.
+- 🟡 `pmd:AtLeastOneConstructor` L350
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L351
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:LocalVariableCouldBeFinal` L352
+  Local variable 'key' could be declared final
+- 🟡 `pmd:HardCodedCryptoKey` L352
+  Do not use hard coded encryption keys
+- 🟡 `pmd:RelianceOnDefaultCharset` L352
+  Specify a character set instead of relying on the default charset
+- 🟡 `pmd:AtLeastOneConstructor` L358
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L359
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:LocalVariableCouldBeFinal` L360
+  Local variable 'iv' could be declared final
+- 🟡 `pmd:AtLeastOneConstructor` L366
+  Each class should declare at least one constructor
+- 🟡 `pmd:CommentDefaultAccessModifier` L367
+  Missing commented default access modifier on method 'bad()'
+- 🟡 `pmd:UseShortArrayInitializer` L368
+  Array initialization can be written shorter
+- 🟡 `pmd:LocalVariableCouldBeFinal` L368
+  Local variable 'iv' could be declared final
+- 🟡 `pmd:InsecureCryptoIv` L368
+  Do not use hard coded initialization vector in crypto operations
+- 🟡 `pmd:CommentDefaultAccessModifier` L371
+  Missing commented default access modifier on method 'alsoBad()'
+- 🟡 `pmd:LocalVariableCouldBeFinal` L372
+  Local variable 'iv' could be declared final
+- 🟡 `pmd:InsecureCryptoIv` L372
+  Do not use hard coded initialization vector in crypto operations
+- 🟡 `pmd:RelianceOnDefaultCharset` L372
+  Specify a character set instead of relying on the default charset
+- 🔵 `pmd:UnnecessaryImport` L12
+  Unused import 'java.util.Hashtable'
+- 🔵 `pmd:UnnecessaryImport` L13
+  Unused import 'java.io.File'
+- 🔵 `pmd:UnnecessaryImport` L15
+  Unused import 'java.io.FileOutputStream'
+- 🔵 `pmd:UnnecessaryImport` L19
+  Unused import 'java.util.Arrays'
+- 🔵 `pmd:DontCallThreadRun` L50
+  Dont call Thread.run() explicitly, use Thread.start()
+- 🔵 `pmd:UnnecessaryFullyQualifiedName` L114
+  Unnecessary qualifier 'java.util': 'Date' is already in scope because it is imported in this file
+- 🔵 `pmd:UseVarargs` L138
+  Consider using varargs for methods or constructors which take an array the last parameter.
+- 🔵 `pmd:UseVarargs` L250
+  Consider using varargs for methods or constructors which take an array the last parameter.