FP S6555 Null pointers should not be dereferenced

[dandoy (Kevin Dandoy)]

SonarQube Enterprise 10.8.1
Language: Java

This FP is occurring when using ‘instance of’. Sonar indicates that ‘rd’ can be null (because table.rolloverData can be null) in the statement ‘rd.reinitialize(table.daysToKeep’ but since ‘instance of’ is used it can never be null.

Since S6555 is not supported in SonarQube IDE Eclipse v10.11 I cannot include a simplified example.

        if (table.rolloverData == null && table.tableColumnDatas != null)
        {
            table.rolloverData = table.isLogDataTable()
                    ? new RolloverLogData(table) 
                    : new RolloverStatisticsData(table);
        }
        else if (table.reinitialize)
        {            
            if (table.rolloverData instanceof RolloverLogData rd)
             { rd.reinitialize(table.daysToKeep); }
        }

[Colin]

Hey Kevin.

In order to help us reproduce the issue, it would be great if you could provide a complete, compilable code sample.

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t. …

When we have to fill in the blanks on what’s missing, it tends to get messy fast.

[dandoy (Kevin Dandoy)]

Since S6555 is not supported in the IDE, only in the Server I cannot generate the warning in the IDE so cannot provide a complete, compilable code sample. I think the sample I provided along with the description should be sufficient for the developer.

[Colin]

A complete, compilable code sample can (and should) still raise an issue in SonarQube Server!

This is a community forum, we expect that users put in their 50% so that we can be effective and efficient when asking developers to spend their time looking at an issue.

Otherwise, you can mark the issue as false-positive and we’ll wait for a report with more details. We’d prefer not to do that.

[dandoy (Kevin Dandoy)]

Yes, I agree a code sample can still raise the issue on SonarQube Server but in our environment I don’t have the ability to submit a code sample to be executed on our SonarQube Server, I can only do it in my IDE which does not support the specified rule. So I guess you’ll have to wait for another report.