Make sure to read this post before raising a thread here:
Product: SonarQube Cloud (CI analysis via Maven)
Language: Java 25
Rule: javabugs:S2259 — A NULL object should not be accessed (“Fix this access that will throw a NullPointerException when executed.”)
Minimal reproducer
The project depends on a library jar (it could be Apache Commons Lang, Spring, Guava or any in-house utility library) that provides a classic null-safe string check:
// In an external dependency (a jar, not part of the analyzed project)
package com.example.lib;
public final class Strings {
public static boolean hasText(CharSequence str) {
if (str == null || str.isEmpty()) {
return false;
}
for (int i = 0; i < str.length(); i++) {
if (!Character.isWhitespace(str.charAt(i))) {
return true;
}
}
return false;
}
}
The analyzed project uses it as a guard before dereferencing a value that may legitimately be null:
import com.example.lib.Strings;
import java.util.Locale;
import java.util.Map;
class Config {
static String read(Map<String, String> props, String key, String defaultValue) {
String value = props.get(key);
return value == null ? defaultValue : value;
}
}
class Mode {
enum Kind { AUTO, MANUAL }
static Kind of(Map<String, String> props) {
String value = Config.read(props, "mode", null);
if (!Strings.hasText(value)) {
return Kind.AUTO;
}
return Kind.valueOf(value.trim().toUpperCase(Locale.ROOT)); // <-- S2259 raised here
}
}
value can never be null when value.trim() is reached: hasText(null) always returns false.
The problem
The issue flow says “Assuming this condition to be false” on !Strings.hasText(value), i.e. it assumes hasText(null) can return true. The engine cannot see the library method, yet it keeps the “may be null” fact and follows a path that is impossible.
This “check with a library helper, then use” idiom is everywhere (StringUtils.isNotBlank, Spring StringUtils.hasText, Guava Strings.isNullOrEmpty, CollectionUtils.isNotEmpty, in-house utilities). Since S2259 is a Major Reliability bug, these false positives lower the rating and can fail the Quality Gate. This rule now raises more false positives than real bugs.
Expected behavior
- By default, do not raise S2259 when the null path depends on the result of a method the engine cannot analyze: a null check hidden in an external library must be given the benefit of the doubt.