Is SpotBugs @DefaultAnnotation supported?

SonarQube Cloud
,
1

If I annotate a class or package with @DefaultAnnotation(NonNull.class) from SpotBugs 4 annotations (package edu.umd.cs.findbugs.annotations) it doesn’t work.
Instead, if I annotate concrete methods with @Nonnull it worked correctly.
Are the @DefaultAnnotation, @DefaulAnnotationForXXXX supported?

I discovered that the @ReturnValuesAreNonnullByDefault, also from SpotBugs, is inherited correctly if I use it in a class, but not inherit if I use it in a package.

2

Hello @lujop,

Welcome to the SonarSource community.
Could you clarify what is the problem with SonarQube here ?

Can you elaborate on what does not work, what works etc…

Just to set expectations, I anticipate that the problem you report might a SpotBugs plugin problem which is not developed and supported by SonarSource, so I my guess reveals correct, you would have to report your problem on the SpotBugs plugin GItHub repo https://github.com/spotbugs/sonar-findbugs/issues

Bye

4

Thank you very much Olivier,

I’m not using SpotBugs, nor have it as a dependency in my project other than it’s annotations. I’ve only taken it’s null analysis annotations to enhance static analysis from my project in Sonarlint/SonarCloud.

I’ve seen that @Nullable, @NonNull are detected and used by SonarCloud.
But it’s tedious to put them everywhere, and here is when the @DefaultAnnotationXXXX would be useful if Sonarcloud were able to interpret them.

And my question was exactly that, are they supported by SonarCloud analysis?
Is there any way I can say that all parameters or all return values of a class or package ar NonNull by default?

Is there any documentation about what annotations are supported and what no by static code analysis?

7

Hello Joan,

OK, thanks for the clarification, now I get it :roll_eyes:.
So we don’t support these annotations and you’ll have to continue making individual annotations.

The idea is however interesting. Yet the problem would be what standard annotations to honor? We would probably not be keen to honor SpotBugs annotations, JSR-305 is not a good choice either (it’s dormant). So what else ? I am not a Java expert but I can’t find a good target.
That to say that we will probably not do anything above what we already honor.
Hope that makes sense.

Regards

8

Hi,

For the record, I found this SO thread few days ago:

You can see that our Java analyzer already supports quite a few of them:

Using @javax.annotation.ParametersAreNonnullByDefault is probably your best option for now.

1 Like