声纳对规则的误报:不应取消引用空指针
我有一个关于这个电话的声纳警报 minRating.getRatgCaam()
I have a sonar alert on this call minRating.getRatgCaam()
警报与声纳规则有关:不应取消引用空指针.
例如:
AgencyRating minRating = null;
.......
if (!getRatingUtilities().isNR(minRating)) {
return minRating.getRatgCaam(); //Sonar: Null pointers should not be dereferenced
}
方法 isNR(minRating) 是一个辅助方法，用于验证对象 minRating 是否为空
The method isNR(minRating) is a helper method that validate among other things, if the object minRating is null
public boolean isNR(AgencyRating rating) {
return rating == null || isNR(rating.getRatgCaam());
}
当我按照声纳的建议添加非空验证时.声纳没问题.
When I added the not null validation as sonar suggest. Sonar is ok.
if (minRating !=null && !getRatingUtilities().isNR(minRating)) {
return minRating.getRatgCaam(); // no more alert
}
Sonar 无法确定辅助方法是否进行了 null 验证.我不需要再次进行此验证.
Sonar can't determine that the helper method did the null validation. I don't need to do this validation again.
我的情况是误报吗?
推荐答案
这确实是一个误报，因为在撰写本文时，sonarqube java 分析器(撰写本文时版本为 4.2.1)不支持跨过程分析因此它无法确定确实，要使条件为真，minRating 的值必须为非空.
This is indeed a false positive because, at time of writing, the sonarqube java analyzer (version 4.2.1 at time of writing) does not support cross procedural analysis and so it is not able to determine that indeed, for the condition to be true, the value of minRating has to be non null.
这是我们目前正在大力开发的一项功能，以便能够关闭此类误报.
This is a feature that we are currently heavily working on to be able to switch off such kind of false positives.
相关文章