filter.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License").
  ~ You may not use this file except in compliance with the License.
  ~ A copy of the License is located at
  ~
  ~  http://aws.amazon.com/apache2.0
  ~
  ~ or in the "license" file accompanying this file. This file is distributed
  ~ on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
  ~ express or implied. See the License for the specific language governing
  ~ permissions and limitations under the License.
  -->

<FindBugsFilter>
    <!-- Ignore all test files. -->
    <Match>
        <Class name="~Test\.java$"/>
    </Match>

    <!-- Equals is overridden in Shape implementations, but hashCode is
         intentionally not overridden since it's unnecessary. -->
    <Match>
        <Package name="software.amazon.smithy.model.shapes"/>
        <Bug pattern="HE_EQUALS_NO_HASHCODE" />
    </Match>

    <!-- The MockManifest uses a hardcoded value for a mock, so
         it makes sense. -->
    <Match>
        <Class name="software.amazon.smithy.build.MockManifest"/>
        <Bug pattern="DMI_HARDCODED_ABSOLUTE_FILENAME"/>
    </Match>

    <!-- This method is definitely called, so it might be a bug
         in spot bugs -->
    <Match>
        <Class name="ReservedWordsValidator$ReservedWords"/>
        <Bug pattern="UPM_UNCALLED_PRIVATE_METHOD"/>
    </Match>

    <!-- Exceptions aren't going to be serialized. -->
    <Match>
        <Bug pattern="SE_NO_SERIALVERSIONID,SE_BAD_FIELD"/>
    </Match>

    <!-- This is definitely cleaned up and not a redundant null check
         software.amazon.smithy.model.loader.ModelAssembler.loadPreludeModel -->
    <Match>
        <Class name="software.amazon.smithy.model.loader.ModelAssembler"/>
        <Bug pattern="OBL_UNSATISFIED_OBLIGATION_EXCEPTION_EDGE,RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE"/>
    </Match>

    <!-- Intentional fall through in a lexer -->
    <Match>
        <Class name="software.amazon.smithy.model.loader.SmithyModelLexer"/>
        <Bug pattern="SF_SWITCH_FALLTHROUGH"/>
    </Match>

    <!-- This is intentional since the # must occur after a namespace. -->
    <Match>
        <Class name="software.amazon.smithy.model.traits.TraitDefinition$Builder"/>
        <Bug pattern="RV_CHECK_FOR_POSITIVE_INDEXOF"/>
    </Match>

    <!-- NoSuchElementException actually is thrown if the deque is empty. -->
    <Match>
        <Class name="software.amazon.smithy.model.traits.WeightedNamedElements$ElementIterator"/>
        <Bug pattern="IT_NO_SUCH_ELEMENT"/>
    </Match>

    <!-- Things are initialized lazily -->
    <Match>
        <Package name="software.amazon.smithy.jsonschema"/>
        <Bug pattern="UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR"/>
    </Match>
    <Match>
        <Package name="software.amazon.smithy.openapi"/>
        <Bug pattern="UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR"/>
    </Match>

    <!-- Try with resources is tripping up spotbugs -->
    <Match>
        <Class name="software.amazon.smithy.utils.IoUtils"/>
        <Bug pattern="RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE"/>
    </Match>

    <!-- This is a false positive. The value is guarded behind an Objects.requireNonNull -->
    <Match>
        <Class name="software.amazon.smithy.model.knowledge.ServiceIndex"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
    </Match>

    <!-- This is a false positive. The value is guarded behind an Objects.requireNonNull -->
    <Match>
        <Class name="software.amazon.smithy.cli.commands.InitCommand"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
    </Match>

    <!-- Using a buffer here would actually allocate more, not less -->
    <Match>
        <Class name="software.amazon.smithy.jsonschema.SchemaDocument"/>
        <Bug pattern="SBSC_USE_STRINGBUFFER_CONCATENATION"/>
    </Match>

    <!-- Objects.requireNonNull does a null existence check -->
    <Match>
        <Class name="software.amazon.smithy.model.knowledge.NeighborProviderIndex"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
    </Match>

    <!-- Spotbugs for some reason isn't seeing that Objects.requireNonNull prevents a null return.
         this is used when dereferencing a WeakReference to the Model. -->
    <Match>
        <Class name="software.amazon.smithy.model.knowledge.HttpBindingIndex"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
    </Match>

    <!-- current is used to create an internal linked list's next value from a list -->
    <Match>
        <Class name="software.amazon.smithy.model.selector.PathFinder$Path"/>
        <Bug pattern="UC_USELESS_OBJECT"/>
    </Match>

    <Match>
        <Class name="software.amazon.smithy.cli.Arguments"/>
        <Bug pattern="EI_EXPOSE_REP2"/>
    </Match>

    <!-- Spotbugs for some reason isn't seeing that Objects.requireNonNull prevents a null return.
         this is used when dereferencing a WeakReference to the Model. -->
    <Match>
        <Class name="software.amazon.smithy.model.knowledge.NullableIndex"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
    </Match>

    <!-- Spotbugs for some reason isn't seeing that Objects.requireNonNull prevents a null return.
         this is used when dereferencing a WeakReference to the Model. -->
    <Match>
        <Class name="software.amazon.smithy.model.knowledge.PropertyBindingIndex"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
    </Match>

    <!-- This is a false positive. The value is guarded behind an Objects.requireNonNull -->
    <Match>
        <Class name="software.amazon.smithy.rulesengine.traits.ContextIndex"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
    </Match>

    <!-- This is a false positive. The value is guarded behind an Objects.requireNonNull -->
    <Match>
        <Class name="software.amazon.smithy.model.validation.testrunner.SmithyTestCase"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
    </Match>

    <!-- We don't care about the return value of putIfAbsent in this cache -->
    <Match>
        <Class name="software.amazon.smithy.model.shapes.ShapeId$ShapeIdFactory"/>
        <Bug pattern="RV_RETURN_VALUE_OF_PUTIFABSENT_IGNORED"/>
    </Match>

    <!-- The FileWriter API that specifies a Charset is not available in Java 8 -->
    <Match>
        <Class name="software.amazon.smithy.cli.commands.WarmupCommand"/>
        <Bug pattern="DM_DEFAULT_ENCODING"/>
    </Match>
    <Match>
        <Class name="software.amazon.smithy.cli.DiffCommandTest"/>
        <Bug pattern="DM_DEFAULT_ENCODING"/>
    </Match>

    <!-- SecurityManager is deprecated and scheduled for removal, so this isn't a good check. -->
    <Match>
        <Bug pattern="DP_CREATE_CLASSLOADER_INSIDE_DO_PRIVILEGED"/>
    </Match>

    <!-- We don't care if files.delete() returns true or false -->
    <Match>
        <Class name="software.amazon.smithy.cli.commands.WarmupCommand"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED_BAD_PRACTICE"/>
    </Match>

    <!-- Intentional fall through to handle aliased args -->
    <Match>
        <Class name="software.amazon.smithy.cli.commands.SelectCommand$Options"/>
        <Bug pattern="SF_SWITCH_FALLTHROUGH"/>
    </Match>

    <!-- It is not worth catching if the closing task of a progress bar fails to execute -->
    <Match>
        <Class name="software.amazon.smithy.cli.commands.ProgressTracker"/>
        <Bug pattern="DE_MIGHT_IGNORE"/>
    </Match>

    <!-- We could mark these as volatile, but in practice we don't share instances across
         threads, so there isn't a need to. This class is private, so we don't have to worry
         about outside
          usage. -->
    <Match>
        <Class name="software.amazon.smithy.cli.commands.ModelBuilder"/>
        <Bug pattern="AT_STALE_THREAD_WRITE_OF_PRIMITIVE"/>
    </Match>

    <!-- This checks for mutability, but it's full of false positives. Among other things, it doesn't
         recognize SetUtils.copyOf and similar as providing immutable collections. -->
    <Match>
        <Bug code="EI,EI2"/>
    </Match>

    <!-- Throwing exceptions in a constructor potentially leaves it open to finalization attacks.
         These likely aren't important in our cases since we rarely if ever handle the sort of
         sensitive data and connections that are at risk. The best way to prevent this is by making
         classes final (or sealed), which we do unless we can't. Making an empty, final finalize
         method also works, but that method is being removed. -->
    <Match>
        <Bug code="CT"/>
    </Match>

    <!-- This is a false positive. Yeah, we have a terminal node that's a singleton, but the ctor is still valid. -->
    <Match>
        <Class name="software.amazon.smithy.rulesengine.logic.cfg.ResultNode" />
        <Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR" />
    </Match>

</FindBugsFilter>