squid:S1948 False positive when field type is not-serializable but assigned serializable object

SonarQube Cloud
1
  • versions used
    • SonarQube 8.0.0 Community, sonar-maven-plugin 3.7.0-1746, SonarJava 5.14.0.18788
    • SonarCloud, sonar-maven-plugin 3.7.0-1746
  • minimal code sample to reproduce
package net.bis5.s1948;

import org.primefaces.model.*;
import java.io.*;

public class S1948App2 implements Serializable {

    // False positive: Make "rootNode" transient or serializable.
    private TreeNode rootNode = new DefaultTreeNode("root node", null);

    // False positive: Make "finalRootNode" transient or serializable.
    private final TreeNode finalRootNode = new DefaultTreeNode("root node", null);

    // False positive: Make "modifiedRootNode" transient or serializable.
    // (IMHO, I think that is not necessarily that means false positive because this field is modifiable through public setter.)
    private TreeNode modifiableRootNode = new DefaultTreeNode("root node", null);

    public TreeNode getRootNode() {
        return rootNode;
    }

    public TreeNode getFinalRootNode() {
        return finalRootNode;
    }

    public TreeNode getModifiableRootNode() {
        return modifiableRootNode;
    }

    public void setModifiableRootNode(TreeNode node) {
        this.modifiableRootNode = node;
    }
}

There is sample project:

1 Like
3

Hey @maruTA-bis5,

First, let me apologize for the veeeeery long time it took to answer you, and thank you for your reproducer. This is indeed an FP to me. If the initializer type is serializable, then there is no such issue.

I created the following ticket to handle it: SONARJAVA-3504

Cheers,
Michael

5

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.