Java new String(byte[]) false positive S2129

Windows vscode with sonarLint v3.12.0 like [Java:S2129] There's no valueOf() for new String(byte[]) reports S2129 with the following:

    public String bubba() {
        return new String(Base64.getEncoder().encode(getVar(EnvVar.BUBBA).getBytes()));
    }
    private String getVar(final EnvVar _v) { return _v.getFromEnvOrProperty(m_settings); }

If I move the EnvVar enum into the same source part then the S2129 goes away. Same if I pass a local quoted string to the encode() like encode("getVar(EnvVar.BUBBA)").

Using a local for the byte array the problem goes away:

        final byte[] b = Base64.getEncoder().encode(getVar(EnvVar.BUBBA).getBytes());
        return new String(b);

The EnvVar in a separate file looks like:

    public enum EnvVar {
        BUBBA("bubba"),
        ;
        private String m_name;
        EnvVar(final String _name) { m_name = _name; }
        @Override public String toString() { return m_name; }
        public String getFromEnvOrProperty(final Settings_s) { final String fromEnv = System.getenv(m_name); return !isNullOrEmpty(fromEnv) ? fromEnv : _s.getProperty(m_name); }
    }

Hi Jon Wold,
I can’t reproduce this problem with code that compiles. My assumption is: SonarLint has some missing dependencies in the classpath, and the java analyzer is not able to know that getVar(EnvVar.BUBBA).getBytes() has the type byte[] instead of String.
In this case, yes I notice a bug in the java analyzer that wrongly approximates to the String(String) constructor, instead of assuming that it does not know which constructor it is.
I have created this SONARJAVA-4376 ticket to not raise false-positives when something is unknown.
But it will not fix your vscode analysis classpath configuration problem. For this, we would need for example to investigate a super small project that could reproduce this false-positive.
Alban

I agree it must have been a local problem – I cannot now reproduce the failure, even after reverting recent changes to what was there 30Nov2022.

Sorry for the hassle and thanks for your attention !
Jon