FALSE POSITIVE: java:S2259 treats a null-qualified static field access as an object dereference

Rules and Languages Report False-positive / False-negative...
1

Affected tool

SonarQube Community Build 26.7.0.124771; sonar-java 8.34

Affected checker

java:S2259

Minimal reproducer

import java.io.File;

class SonarNullStaticFieldAccess {
    void test() {
        File file = null;
        String separator = file.separator;
    }
}

Reproduction command

sonar-scanner --version

sonar-scanner -Dsonar.projectKey=s2259-reproducer -Dsonar.sources=sonarqube-s2259-fp-null-static-field-access.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube reports java:S2259 at line 6. Two adapter-based runs against SonarQube Community Build 26.7.0.124771 produced the same finding.

Expected behavior

S2259 should not report this line. File.separator is a static field; Java resolves the access to the class field and does not dereference the null value of file.

4

Hi @marktiwnzhao and thank you for your report.

I can reproduce the issue on the community edition of SonarQube which uses an old engine, but the issue is no longer present on enterprise one which uses a new engine.

You can try the latter by performing your analysis on SonarQube Cloud.

Best regards,
Marco