# Commons-lang StringUtils isNotBlank method still raise NPE

**URL:** <https://community.sonarsource.com/t/commons-lang-stringutils-isnotblank-method-still-raise-npe/21517>\
**Category:** Report False-positive / False-negative...\
**Tags:** java\
**Created:** [March 12, 2020, 9:47am UTC](https://community.sonarsource.com/t/commons-lang-stringutils-isnotblank-method-still-raise-npe/21517 "2020-03-12T09:47:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gebitang](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/gebitang/32/16117_2.png) [@gebitang](https://community.sonarsource.com/u/gebitang)\
**Post date:** [March 12, 2020, 9:47am UTC](https://community.sonarsource.com/t/commons-lang-stringutils-isnotblank-method-still-raise-npe/21517/1 "2020-03-12T09:47:56Z")

</div>

Does Sonar support commons-lang StringUtils ?

```auto
<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-lang3</artifactId>
    <version>3.7</version>
 </dependency>

```

Env:

```auto
INFO: SonarQube Scanner 3.2.0.1227
INFO: Java 1.8.0_121 Oracle Corporation (64-bit)
INFO: Linux 4.19.2-1.el7.elrepo.x86_64 amd64

Community EditionVersion 7.6 (build 21501)

```

code to reproduce this issue:

```auto
public class DetectorImport {
    public String check1(Nonentity nonentity) {
        String s;
        if(nonentity == null) {
            s = null;
        }else {
            s = nonentity.getName();
        }
        if(StringUtils.isNotBlank(s)) {
            s = s.replaceAll("（", "(");
        }
        return s;
    }
}

```

 ![NPE](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/2X/3/318735b08e742b4bab065a9821caa48762a4c697.png)

[[JAVA] squid:S2259 False Positive with Utility methods](https://groups.google.com/forum/#!topic/sonarqube/aluTP63hfyA)  
from this thread, I get the following info:

> We currently support methods from commons-lang StringUtils ([v2](https://commons.apache.org/proper/commons-lang/javadocs/api-2.6/org/apache/commons/lang/StringUtils.html), and [v3](https://www.google.com/url?q=https%3A%2F%2Fcommons.apache.org%2Fproper%2Fcommons-lang%2Fapidocs%2Forg%2Fapache%2Fcommons%2Flang3%2FStringUtils.html&sa=D&sntz=1&usg=AFQjCNHiDHLeUkFJvzevRg_dwUkvTbt8nA)), guava [preconditions](https://google.github.io/guava/releases/snapshot/api/docs/com/google/common/base/Preconditions.html#checkNotNull-T-), and java 8 methods from java.util.Objects (nonNull, isNull, requireNonNull). As we know how these methods behave, we are able to correctly handle such call and discard similar FPs. Of course, I don’t want to force you using such libraries to make the analyzer happy. 🙂

According to this thread [Sonarqube is raising false-positive NPE](https://community.sonarsource.com/t/sonarqube-is-raising-false-positive-npe/4515), NullPointer issue should be checked in the same file.

changing above code to following one indeed solve this issue:

```auto
public class DetectorImport {

    public String check1(Nonentity nonentity) {
        String s;
        if(nonentity == null) {
            s = null;
        }else {
            s = nonentity.getName();
        }
        if(s !=null) {
            s = s.replaceAll("（", "(");
        }

        return s;
    }
}

```

It seems that commons-lang StringUtils isn’t supported yet ☹

---

<div class="post-metadata">

**Author:** ![arungeorge101](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@arungeorge101](https://community.sonarsource.com/u/arungeorge101)\
**Post date:** [March 12, 2020, 5:02pm UTC](https://community.sonarsource.com/t/commons-lang-stringutils-isnotblank-method-still-raise-npe/21517/2 "2020-03-12T17:02:03Z")

</div>

We have the same issue.

SonarQube Scanner 3.3.0.1492  
12:41:32.334 INFO: Java 1.8.0\_222 Oracle Corporation (64-bit)  
12:41:32.334 INFO: Linux 3.10.0-957.27.2.el7.x86\_64 amd64  
12:41:33.039 DEBUG: Enterprise 7.9.1.27448

---

<div class="post-metadata">

**Author:** ![Quentin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/quentin/32/74716_2.png) [@Quentin](https://community.sonarsource.com/u/Quentin)\
**Post date:** [March 13, 2020, 12:33pm UTC](https://community.sonarsource.com/t/commons-lang-stringutils-isnotblank-method-still-raise-npe/21517/3 "2020-03-13T12:33:05Z")

</div>

Hello

Welcome to the community and thanks for the clear description of your problem.

By looking at [this file](https://github.com/SonarSource/sonar-java/blob/master/java-frontend/src/test/files/se/CommonsLang3StringUtilsMethods.java), it seems that we are supporting StringUtils since already a few years.  
I tried with a simple maven project (with [SonarScanner for Maven](https://docs.sonarqube.org/latest/analysis/scan/sonarscanner-for-maven/)), and `StringUtils.isNotBlank` is correctly handled.

Then I tried to analyze the same project directly with [SonarScanner](https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/), without correctly setting up any properties. In this case, the FP appears.  
I expect you will find the message:

```auto
WARN: Bytecode of dependencies was not provided for analysis of source files, you might end up with less precise results. Bytecode can be provided using sonar.java.libraries property.

```

in the logs, I believe “less precise results” describes well the problem you face here.

All in all, you should consider using SonarScanner for Maven. If not possible (for any reason), you should make sure the project is correctly configured.

Feel free to come back with more details (how you run the analysis, logs, properties), if you still face the issue.

Hope this helps,

Quentin

---

<div class="post-metadata">

**Author:** ![arungeorge101](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@arungeorge101](https://community.sonarsource.com/u/arungeorge101)\
**Post date:** [March 13, 2020, 8:02pm UTC](https://community.sonarsource.com/t/commons-lang-stringutils-isnotblank-method-still-raise-npe/21517/4 "2020-03-13T20:02:06Z")

</div>

I looked through my logs but I didnt see any “Bytecode of dependencies was not provided” warning.

We are using the SonarScanner and not the maven sonar plugin. And for us the issue was that the “sonar.java.libraries” variable was not properly set. I added the target “dependency:copy-dependencies” as part of the maven execution. This copied all the dependencies to the right location, then I set the property “-Dsonar.java.libraries=target/dependency” in our case.

---

<div class="post-metadata">

**Author:** ![Quentin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/quentin/32/74716_2.png) [@Quentin](https://community.sonarsource.com/u/Quentin)\
**Post date:** [March 16, 2020, 8:11am UTC](https://community.sonarsource.com/t/commons-lang-stringutils-isnotblank-method-still-raise-npe/21517/5 "2020-03-16T08:11:55Z")

</div>

Glad to see that you managed to find a working configuration.

Indeed, this log arises when the property is not set, not when the dependencies are actually missing.  
There is already a ticket ([SONARJAVA-3114](https://jira.sonarsource.com/browse/SONARJAVA-3114)) to improve this situation, we will make sure that the confusion you faced won’t happen again.

Best,  
Quentin

---

<div class="post-metadata">

**Author:** ![gebitang](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/gebitang/32/16117_2.png) [@gebitang](https://community.sonarsource.com/u/gebitang)\
**Post date:** [March 17, 2020, 2:18am UTC](https://community.sonarsource.com/t/commons-lang-stringutils-isnotblank-method-still-raise-npe/21517/6 "2020-03-17T02:18:04Z")

</div>

You are right, Quentin.

There is Warning in SonarQube web saying that:

> Bytecode of dependencies was not provided for analysis of source files, you might end up with less precise results. Bytecode can be provided using sonar.java.libraries property.

Thanks to [Arungeorge101](https://community.sonarsource.com/u/arungeorge101) . I tryed your solution manually and it works indeed.