FP java:S2259 Nullable & generic type parameters

SonarQube Server / Community Build
1

Rule S2259 reports one false positive issue about potential NullPointerExceptions for the the following code:

import org.checkerframework.checker.nullness.qual.NonNull;
import org.checkerframework.checker.nullness.qual.Nullable;

import java.util.ArrayList;
import java.util.Collection;
import java.util.Iterator;
import java.util.List;
import java.util.function.BiFunction;

public class S2259NullableGenericTypeParameters {

    public static <LE, RE, PE, L extends Collection<LE>, R extends Collection<RE>> List<PE> s2259(
        final @NonNull L left,
        final @NonNull R right,
        final @NonNull BiFunction<@Nullable LE, @Nullable RE, PE> combiner
    ) {
        final Iterator<LE> leftIterator = left.iterator();
        final Iterator<RE> rightIterator = right.iterator();
        final List<PE> results = new ArrayList<>();
        results.add(combiner.apply(leftIterator.next(), rightIterator.next())); // SonarQube: A "NullPointerException" could be thrown; "combiner" is nullable here.
        return results;
    }

}
  1. Null pointers should not be dereferenced java:S2259
  2. SonarQube Community Build v24.12.0.100206
  3. Java Code

Since combiner is annotated with @NonNull, it will never be null. Based on this assumption, I removed the @Nullable annotations from the two generic type parameters LE and RE, and SonarQube no longer reports any issues.

Marino

2

Hi Marino,

Welcome to the community!

In SonarQube Cloud and current versions of SonarQube Server, that rule has been moved to javabugs:S2259 and its performance improved. No further work is anticipated on the version of java:S2259 that remains in SonarQube Community Build.

Please let us know if you still see this once you upgrade.

 
Thx,
Ann

3

Hi Ann,

do you suggest we need to upgrade the Community Build to the Server version?

Thx,
Marino

4

Hi Marino,

At the risk of sounding like a corporate shill, yes. You’ll get more/better rules including taint analysis, and extended functionality such as PR analysis and decoration.

 
Ann

5

Hi Ann,

Unfortunately, we don’t have widespread usage at the moment to justify an upgrade, but we hope for the near future.

Many thanks,
Marino

1 Like