Skip to content

Commit b51439c

Browse files
cconloncconlon
committed
JNI/JSSE: Add SpotBugs exclusions for reviewed warnings
1 parent 6b59646 commit b51439c

1 file changed

Lines changed: 369 additions & 1 deletion

File tree

‎spotbugs-exclude.xml‎

Lines changed: 369 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -283,7 +283,8 @@
283283
</Match>
284284

285285
<!--
286-
IS2_INCONSISTENT_SYNC: WolfSSLEngine.ssl and
286+
IS2_INCONSISTENT_SYNC: WolfSSLEngine.ssl,
287+
extraDebugEnabled, and ioDebugEnabled, and
287288
WolfSSLSocket.ssl fields set in constructor (before
288289
publication), unsynchronized reads only in debug logging
289290
lambdas (read-only, non-critical).
@@ -293,10 +294,377 @@
293294
<Field name="ssl"/>
294295
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
295296
</Match>
297+
<Match>
298+
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
299+
<Field name="extraDebugEnabled"/>
300+
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
301+
</Match>
302+
<Match>
303+
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
304+
<Field name="ioDebugEnabled"/>
305+
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
306+
</Match>
296307
<Match>
297308
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
298309
<Field name="ssl"/>
299310
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
300311
</Match>
301312

313+
<!--
314+
IS2_INCONSISTENT_SYNC: WolfSSLParameters array-based
315+
getters/setters (cipherSuites, protocols, applicationProtocols)
316+
and copy() are synchronized. Remaining primitive
317+
getters/setters (booleans, ints) are intentionally not
318+
synchronized since primitive reads/writes are atomic and
319+
objects are copied before sharing across threads.
320+
-->
321+
<Match>
322+
<Class name=
323+
"com.wolfssl.provider.jsse.WolfSSLParameters"/>
324+
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
325+
</Match>
326+
327+
<!--
328+
NM_METHOD_NAMING_CONVENTION: Public native JNI methods use
329+
PascalCase to match native wolfSSL C function naming.
330+
Renaming would break existing users and require updating
331+
native JNI C code.
332+
-->
333+
<Match>
334+
<Class name="com.wolfssl.WolfSSL"/>
335+
<Bug pattern="NM_METHOD_NAMING_CONVENTION"/>
336+
</Match>
337+
338+
<!--
339+
MS_PKGPROTECT: Public API constants in WolfSSL documented
340+
in Javadoc as values users pass to methods like
341+
getExtensionSet(), setKeyUsage(), setPublicKey(), etc.
342+
Reducing visibility would break users.
343+
-->
344+
<Match>
345+
<Class name="com.wolfssl.WolfSSL"/>
346+
<Field name="NID_surname"/>
347+
<Bug pattern="MS_PKGPROTECT"/>
348+
</Match>
349+
<Match>
350+
<Class name="com.wolfssl.WolfSSL"/>
351+
<Field name="NID_serialNumber"/>
352+
<Bug pattern="MS_PKGPROTECT"/>
353+
</Match>
354+
<Match>
355+
<Class name="com.wolfssl.WolfSSL"/>
356+
<Field name="NID_pkcs9_unstructuredName"/>
357+
<Bug pattern="MS_PKGPROTECT"/>
358+
</Match>
359+
<Match>
360+
<Class name="com.wolfssl.WolfSSL"/>
361+
<Field name="NID_pkcs9_contentType"/>
362+
<Bug pattern="MS_PKGPROTECT"/>
363+
</Match>
364+
<Match>
365+
<Class name="com.wolfssl.WolfSSL"/>
366+
<Field name="NID_pkcs9_challengePassword"/>
367+
<Bug pattern="MS_PKGPROTECT"/>
368+
</Match>
369+
<Match>
370+
<Class name="com.wolfssl.WolfSSL"/>
371+
<Field name="NID_givenName"/>
372+
<Bug pattern="MS_PKGPROTECT"/>
373+
</Match>
374+
<Match>
375+
<Class name="com.wolfssl.WolfSSL"/>
376+
<Field name="NID_initials"/>
377+
<Bug pattern="MS_PKGPROTECT"/>
378+
</Match>
379+
<Match>
380+
<Class name="com.wolfssl.WolfSSL"/>
381+
<Field name="NID_key_usage"/>
382+
<Bug pattern="MS_PKGPROTECT"/>
383+
</Match>
384+
<Match>
385+
<Class name="com.wolfssl.WolfSSL"/>
386+
<Field name="NID_subject_alt_name"/>
387+
<Bug pattern="MS_PKGPROTECT"/>
388+
</Match>
389+
<Match>
390+
<Class name="com.wolfssl.WolfSSL"/>
391+
<Field name="NID_basic_constraints"/>
392+
<Bug pattern="MS_PKGPROTECT"/>
393+
</Match>
394+
<Match>
395+
<Class name="com.wolfssl.WolfSSL"/>
396+
<Field name="NID_ext_key_usage"/>
397+
<Bug pattern="MS_PKGPROTECT"/>
398+
</Match>
399+
<Match>
400+
<Class name="com.wolfssl.WolfSSL"/>
401+
<Field name="NID_dnQualifier"/>
402+
<Bug pattern="MS_PKGPROTECT"/>
403+
</Match>
404+
<Match>
405+
<Class name="com.wolfssl.WolfSSL"/>
406+
<Field name="RSAk"/>
407+
<Bug pattern="MS_PKGPROTECT"/>
408+
</Match>
409+
<Match>
410+
<Class name="com.wolfssl.WolfSSL"/>
411+
<Field name="ECDSAk"/>
412+
<Bug pattern="MS_PKGPROTECT"/>
413+
</Match>
414+
415+
<!--
416+
FI_FINALIZER_NULLS_FIELDS: Finalizers null out fields as
417+
defensive cleanup for JNI native resources. Nulling ensures
418+
references to native pointers and shared objects don't
419+
linger if something holds a reference to the finalized
420+
object. The finalizers also do real work (freeSSL(),
421+
store.clear()). Harmless and intentional.
422+
-->
423+
<Match>
424+
<Class name="com.wolfssl.provider.jsse.WolfSSLAuthStore"/>
425+
<Method name="finalize"/>
426+
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
427+
</Match>
428+
<Match>
429+
<Class name="com.wolfssl.provider.jsse.WolfSSLContext"/>
430+
<Method name="finalize"/>
431+
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
432+
</Match>
433+
<Match>
434+
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
435+
<Method name="finalize"/>
436+
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
437+
</Match>
438+
<Match>
439+
<Class name=
440+
"com.wolfssl.provider.jsse.WolfSSLEngineHelper"/>
441+
<Method name="finalize"/>
442+
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
443+
</Match>
444+
<Match>
445+
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
446+
<Method name="finalize"/>
447+
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
448+
</Match>
449+
<Match>
450+
<Class name="com.wolfssl.provider.jsse.WolfSSLTrustX509"/>
451+
<Method name="finalize"/>
452+
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
453+
</Match>
454+
455+
<!--
456+
PA_PUBLIC_PRIMITIVE_ATTRIBUTE: WolfSSLDebug public debug
457+
flags are public API for users to check/control debug
458+
logging at runtime.
459+
-->
460+
<Match>
461+
<Class name="com.wolfssl.WolfSSLDebug"/>
462+
<Field name="DEBUG"/>
463+
<Bug pattern="PA_PUBLIC_PRIMITIVE_ATTRIBUTE"/>
464+
</Match>
465+
<Match>
466+
<Class name="com.wolfssl.WolfSSLDebug"/>
467+
<Field name="DEBUG_JNI"/>
468+
<Bug pattern="PA_PUBLIC_PRIMITIVE_ATTRIBUTE"/>
469+
</Match>
470+
<Match>
471+
<Class name="com.wolfssl.WolfSSLDebug"/>
472+
<Field name="DEBUG_JSON"/>
473+
<Bug pattern="PA_PUBLIC_PRIMITIVE_ATTRIBUTE"/>
474+
</Match>
475+
476+
<!--
477+
AT_STALE_THREAD_WRITE_OF_PRIMITIVE: WolfSSLParameters
478+
objects are copied via copy() before being shared across
479+
threads, providing the thread-safety boundary. Matching
480+
the JDK SSLParameters pattern which also does not
481+
synchronize primitive getters/setters.
482+
483+
WolfSSLImplementSSLSession.side is set once during setup
484+
before the session is used across threads.
485+
-->
486+
<Match>
487+
<Class name=
488+
"com.wolfssl.provider.jsse.WolfSSLParameters"/>
489+
<Bug pattern="AT_STALE_THREAD_WRITE_OF_PRIMITIVE"/>
490+
</Match>
491+
<Match>
492+
<Class name=
493+
"com.wolfssl.provider.jsse.WolfSSLImplementSSLSession"/>
494+
<Field name="side"/>
495+
<Bug pattern="AT_STALE_THREAD_WRITE_OF_PRIMITIVE"/>
496+
</Match>
497+
498+
<!--
499+
RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE: Defensive null
500+
check on getSession() return value. The session could be
501+
null depending on engine state, keeping as defensive check.
502+
-->
503+
<Match>
504+
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
505+
<Method name="cacheRequestedServerNamesFromNetData"/>
506+
<Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE"/>
507+
</Match>
508+
509+
<!--
510+
RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE: Defensive null check
511+
on certPem in catch block after constructor threw. Kept as
512+
defensive coding to free native resources if constructor
513+
behavior changes in the future.
514+
-->
515+
<Match>
516+
<Class name=
517+
"com.wolfssl.provider.jsse.WolfSSLTrustManager"/>
518+
<Method name="LoadAndroidSystemCertsManually"/>
519+
<Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE"/>
520+
</Match>
521+
522+
<!--
523+
DCN_NULLPOINTER_EXCEPTION: Intentional catch of
524+
NullPointerException. close() uses it to detect calls from
525+
super() before object init. I/O callbacks catch it
526+
defensively when socket/stream may be nulled by another
527+
thread during close. InputStream wraps it in IOException.
528+
-->
529+
<Match>
530+
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
531+
<Method name="close"/>
532+
<Bug pattern="DCN_NULLPOINTER_EXCEPTION"/>
533+
</Match>
534+
<Match>
535+
<Class name=
536+
"com.wolfssl.provider.jsse.WolfSSLSocket$SocketSendCallback"/>
537+
<Method name="sendCallback"/>
538+
<Bug pattern="DCN_NULLPOINTER_EXCEPTION"/>
539+
</Match>
540+
<Match>
541+
<Class name=
542+
"com.wolfssl.provider.jsse.WolfSSLSocket$SocketRecvCallback"/>
543+
<Method name="receiveCallback"/>
544+
<Bug pattern="DCN_NULLPOINTER_EXCEPTION"/>
545+
</Match>
546+
<Match>
547+
<Class name=
548+
"com.wolfssl.provider.jsse.WolfSSLSocket$WolfSSLInputStream"/>
549+
<Method name="read"/>
550+
<Bug pattern="DCN_NULLPOINTER_EXCEPTION"/>
551+
</Match>
552+
553+
<!--
554+
REC_CATCH_EXCEPTION: WolfSSLParametersHelper uses reflection
555+
for Java version compatibility. catch(Exception) is the
556+
standard pattern for reflection calls that may throw
557+
NoSuchMethodException, IllegalAccessException,
558+
InvocationTargetException, ClassNotFoundException, etc.
559+
on older Java versions where methods don't exist.
560+
-->
561+
<Match>
562+
<Class name=
563+
"com.wolfssl.provider.jsse.WolfSSLParametersHelper"/>
564+
<Bug pattern="REC_CATCH_EXCEPTION"/>
565+
</Match>
566+
<Match>
567+
<Class name=
568+
"com.wolfssl.provider.jsse.WolfSSLParametersHelper$1"/>
569+
<Bug pattern="REC_CATCH_EXCEPTION"/>
570+
</Match>
571+
572+
<!--
573+
DE_MIGHT_IGNORE: Same reflection compatibility code as
574+
above. Exceptions are intentionally ignored when methods
575+
don't exist on older Java versions.
576+
-->
577+
<Match>
578+
<Class name=
579+
"com.wolfssl.provider.jsse.WolfSSLParametersHelper"/>
580+
<Method name="decoupleParams"/>
581+
<Bug pattern="DE_MIGHT_IGNORE"/>
582+
</Match>
583+
<Match>
584+
<Class name=
585+
"com.wolfssl.provider.jsse.WolfSSLParametersHelper"/>
586+
<Method name="importParams"/>
587+
<Bug pattern="DE_MIGHT_IGNORE"/>
588+
</Match>
589+
590+
<!--
591+
VA_FORMAT_STRING_USES_NEWLINE: JSON format requires \n per
592+
spec (not platform-specific %n). Hex dump formatting also
593+
needs consistent \n across platforms.
594+
-->
595+
<Match>
596+
<Class name="com.wolfssl.WolfSSLDebug$JSONFormatter"/>
597+
<Method name="format"/>
598+
<Bug pattern="VA_FORMAT_STRING_USES_NEWLINE"/>
599+
</Match>
600+
<Match>
601+
<Class name="com.wolfssl.WolfSSLDebug"/>
602+
<Method name="logHex"/>
603+
<Bug pattern="VA_FORMAT_STRING_USES_NEWLINE"/>
604+
</Match>
605+
606+
<!--
607+
MS_CANNOT_BE_FINAL: WolfSSL.devId is intentionally mutable,
608+
set at runtime by users via WolfSSLProvider.setDevId() to
609+
configure crypto callback device ID.
610+
-->
611+
<Match>
612+
<Class name="com.wolfssl.WolfSSL"/>
613+
<Field name="devId"/>
614+
<Bug pattern="MS_CANNOT_BE_FINAL"/>
615+
</Match>
616+
617+
<!--
618+
ESync_EMPTY_SYNC: Empty synchronized block in close() is
619+
intentional. Used to detect if close() is called from
620+
super() constructor before WolfSSLSocket fields are
621+
initialized. If handshakeLock is null (not yet init),
622+
NPE is caught and TLS shutdown is skipped.
623+
-->
624+
<Match>
625+
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
626+
<Method name="close"/>
627+
<Bug pattern="ESync_EMPTY_SYNC"/>
628+
</Match>
629+
630+
<!--
631+
ENV_USE_PROPERTY_INSTEAD_OF_ENV: getJavaHome() intentionally
632+
checks JAVA_HOME env var first, then falls back to
633+
java.home property. JAVA_HOME and java.home can point to
634+
different locations (JDK root vs JRE within it).
635+
-->
636+
<Match>
637+
<Class name="com.wolfssl.provider.jsse.WolfSSLUtil"/>
638+
<Method name="getJavaHome"/>
639+
<Bug pattern="ENV_USE_PROPERTY_INSTEAD_OF_ENV"/>
640+
</Match>
641+
642+
<!--
643+
SE_TRANSIENT_FIELD_NOT_RESTORED: Lock fields in
644+
WolfSSLCertificate and WolfSSLCRL are marked transient to
645+
satisfy Android Gradle -Werror serialization warnings.
646+
These classes are not actually serialized, so the fields
647+
not being restored after deserialization is not a concern.
648+
-->
649+
<Match>
650+
<Class name="com.wolfssl.WolfSSLCertificate"/>
651+
<Field name="stateLock"/>
652+
<Bug pattern="SE_TRANSIENT_FIELD_NOT_RESTORED"/>
653+
</Match>
654+
<Match>
655+
<Class name="com.wolfssl.WolfSSLCertificate"/>
656+
<Field name="x509Lock"/>
657+
<Bug pattern="SE_TRANSIENT_FIELD_NOT_RESTORED"/>
658+
</Match>
659+
<Match>
660+
<Class name="com.wolfssl.WolfSSLCRL"/>
661+
<Field name="stateLock"/>
662+
<Bug pattern="SE_TRANSIENT_FIELD_NOT_RESTORED"/>
663+
</Match>
664+
<Match>
665+
<Class name="com.wolfssl.WolfSSLCRL"/>
666+
<Field name="crlLock"/>
667+
<Bug pattern="SE_TRANSIENT_FIELD_NOT_RESTORED"/>
668+
</Match>
669+
302670
</FindBugsFilter>

0 commit comments

Comments
 (0)