SonarJava does support interprocedural analysis?(NPE)

java

(Dreaminpast) #1
A.java <- class A { static String foo() { return null;}}
B.java <- class B { String bar(){ A.foo().xxx();}}

Here B.java, A.foo() returns null, it should raise NPE, but the sonarJava doesn’t report this problem…
Does sonarJava support cross-file (interprocedural analysi)?


(Nicolas Peru) #2

Short answer is : no.

Longer answer is : we have some behaviors of well known methods that are read into bytecode and avalaible for such kind of rules. So yes for a very limited scope as of today.
We do have in mind do develop some technologies and tools in order to detect such cases but this is way to early to commit to anything yet…