squid:S1948 False positive when field type is not-serializable but assigned serializable object

  • versions used
    • SonarQube 8.0.0 Community, sonar-maven-plugin 3.7.0-1746, SonarJava 5.14.0.18788
    • SonarCloud, sonar-maven-plugin 3.7.0-1746
  • minimal code sample to reproduce
package net.bis5.s1948;

import org.primefaces.model.*;
import java.io.*;

public class S1948App2 implements Serializable {

    // False positive: Make "rootNode" transient or serializable.
    private TreeNode rootNode = new DefaultTreeNode("root node", null);

    // False positive: Make "finalRootNode" transient or serializable.
    private final TreeNode finalRootNode = new DefaultTreeNode("root node", null);

    // False positive: Make "modifiedRootNode" transient or serializable.
    // (IMHO, I think that is not necessarily that means false positive because this field is modifiable through public setter.)
    private TreeNode modifiableRootNode = new DefaultTreeNode("root node", null);

    public TreeNode getRootNode() {
        return rootNode;
    }

    public TreeNode getFinalRootNode() {
        return finalRootNode;
    }

    public TreeNode getModifiableRootNode() {
        return modifiableRootNode;
    }

    public void setModifiableRootNode(TreeNode node) {
        this.modifiableRootNode = node;
    }
}

There is sample project: