False positive : apache commons StringUtils::isNotBlank should be considered a valid "null check"

[Filip (Philippe Deslauriers)]

java:S2259
SonarQube * Enterprise Edition* Version 9.2.4 (build 50792)

    private List<String> getEnvPropertyList(String propName) {
        List<String> propList = emptyList();
        String propValue = env.getProperty(propName);
        if (isNotBlank(propValue)) {
            propList = List.of(propValue.split(","));
        }
        return propList;
    }

[Colin]

Hey there.

Take a look at this post here.

Commons-lang StringUtils isNotBlank method still raise NPE

Hello Welcome to the community and thanks for the clear description of your problem. By looking at this file, it seems that we are supporting StringUtils since already a few years. I tried with a simple maven project (with SonarScanner for Maven), and StringUtils.isNotBlank is correctly handled. Then I tried to analyze the same project directly with SonarScanner, without correctly setting up any properties. In this case, the FP appears. I expect you will find the message: WARN: Bytecode of…

[Filip (Philippe Deslauriers)]

I found the problem.
The static import was referencing and obsolete version of StringUtils

Thanks