SonarJava 5.3 squid:S4449 false positive for nullability with Guava 25.0-jre

[andreas...@coremedia.com]

Hi,

in the following example, squid:S4449 of SonarJava 5.3 complains about a call to Guava's Strings.isNullOrEmpty(s) with

"Annotate the parameter with @javax.annotation.Nullable in method 'isNullOrEmpty' declaration, or make sure that null can not be passed as argument."

package com.example;

import com.google.common.base.Strings;
import javax.annotation.Nullable;

public class S4449 {
  public String m(@Nullable String s) {
    return Strings.isNullOrEmpty(s) ? "foo" : "bar"; // <-- squid:S4449 complains
  }
}

Note that I'm using Guava 25.0-jre here. Guava uses different nullability annotations, the parameter of Strings#isNullOrEmpty is annotated with org.checkerframework.checker.nullness.compatqual.NullableDecl.

I first thought this could be SONARJAVA-2734, so I checked again with a snapshot build from the master branch (commit 47c01ec86d87517886b02e6dde93260cbba900bc) which should have a fix for SONARJAVA-2734, but I got the same error.

Is this a known bug? Any plans to fix it?

Thank you,
Andreas

[andreas...@coremedia.com]

Hi,

could you please have a look at this issue?

Or is there another place where I should report bugs for the SonarJava plugin? It seems I don't have permission to create bugs at https://jira.sonarsource.com or https://github.com/SonarSource/sonar-java

Regards,

Andreas

[andreas...@coremedia.com]

The problem can still be reproduced with SonarJava 5.4 and Guava 25.1-jre.

[Michael Gumowski]

Hello Andreas,

Thanks a lot for the reproducer. It's indeed an issue on SonarJava side, caused by the fact that we are not supporting checker framework nullness annatotions yet in our Symbolic Execution engine.

I created the following ticket to handle this: SONARJAVA-2776

Regards,

Michael

--
Important: this SonarQube Google Group will close on June 11th, 2018, in order to move to a new forum to power even more community discussions. See details in this post: https://groups.google.com/d/msg/sonarqube/BbSZz-JnhVM/DavhMueEAAAJ
---
You received this message because you are subscribed to the Google Groups "SonarQube" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sonarqube+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/d6e1b9ce-73e9-4a94-b084-2b573c564cc8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Michael Gumowski | SonarSource

Software Developer, Language Team
https://www.sonarsource.com