Possible false positive with `java:S2755`

[hannes]

Make sure to read this post before raising a thread here:

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t. …

Then tell us:

• What language is this for?

  • Java

• Which rule?

  • S2755

• Why do you believe it’s a false-positive/false-negative?

  • Our code sets transformerFactory.setAttribute(ACCESS_EXTERNAL_DTD, "");
    but still triggers a failure of the rule “Disable access to external entities in XML parsing”

• Are you using

  • SonarCloud

• How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)

  • Permalink to GitHub: ris-adm-literature/backend/src/main/java/de/bund/digitalservice/ris/adm_literature/documentation_unit/converter/xml/DomXmlWriter.java at 8342f2ad524d79115bd3b25df9a8783796ae9951 · digitalservicebund/ris-adm-literature · GitHub

  • Triggers S2755:

    

• Checking the docs on TransformerFactory’s setAttribute() and "ACCESS_EXTERNAL_DTD (“an empty string to deny all access to external references”) seem to say differently.

[Dorian_Burihabwa]

Hey @hannes,
Sorry for the very late reply. It looks like the method you are using is indeed safe and you should mark the issue as a false positive. The method you are using is actually listed as part of the methods to accept in this ticket.

Unfortunately, our symbolic execution engine is been on a hiatus for a little while for now and I cannot give you a timeline of when these improvements will be implemented just yet. We will try to clarify that and provide an update as soon as we have one.

Cheers,

Dorian

[hannes]

Thanks for the update!