703 lines
24 KiB
XML
703 lines
24 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!--
|
|
SpotBugs exclusion filter for wolfSSL JNI/JSSE
|
|
|
|
This file lists bugs that have been reviewed and determined to be
|
|
intentional design decisions or false positives.
|
|
|
|
Documentation:
|
|
https://spotbugs.readthedocs.io/en/stable/filter.html
|
|
-->
|
|
<FindBugsFilter>
|
|
|
|
<!--
|
|
EI_EXPOSE_REP: Methods returning internal mutable objects.
|
|
|
|
getSNIServerNames(): all callers are internal JSSE classes
|
|
that only read from the returned list.
|
|
|
|
getSessionContext(): required by SSLSession interface, must
|
|
return the actual context object.
|
|
|
|
getVerifyException(): returns an Exception object which is
|
|
effectively immutable.
|
|
|
|
getOutputStream(): standard Socket API contract requires
|
|
returning the same stream instance.
|
|
-->
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLImplementSSLSession"/>
|
|
<Method name="getSNIServerNames"/>
|
|
<Bug pattern="EI_EXPOSE_REP"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLImplementSSLSession"/>
|
|
<Method name="getSessionContext"/>
|
|
<Bug pattern="EI_EXPOSE_REP"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLInternalVerifyCb"/>
|
|
<Method name="getVerifyException"/>
|
|
<Bug pattern="EI_EXPOSE_REP"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
|
|
<Method name="getOutputStream"/>
|
|
<Bug pattern="EI_EXPOSE_REP"/>
|
|
</Match>
|
|
|
|
<!--
|
|
EI_EXPOSE_REP2: Internal classes storing references to other
|
|
internal objects. These classes are all part of the wolfJSSE
|
|
provider and are created/owned together - they need shared
|
|
mutable state by design. Cloning would break expected
|
|
behavior and add unnecessary overhead.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLSession"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
|
|
<Method name="unwrap"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLImplementSSLSession"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLInternalVerifyCb"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLKeyX509"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLProvider$JSSEFIPSErrorCallback"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLServerSocket"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLServerSocketFactory"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLSessionContext"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLSocketFactory"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLTrustX509"/>
|
|
<Bug pattern="EI_EXPOSE_REP2"/>
|
|
</Match>
|
|
|
|
<!--
|
|
ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD: WolfSSL constructor
|
|
populates static fields (NID_*, wolfssl_*, cipher/hash/key
|
|
type enums, TLS 1.3 secret enums) from native JNI calls.
|
|
These values come from native wolfSSL at runtime and cannot
|
|
be compile-time constants. The constructor is the library
|
|
initialization point, writing statics here is by design.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD"/>
|
|
</Match>
|
|
|
|
<!--
|
|
ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD: WolfSSLProvider
|
|
constructor sets static sslLib singleton. Only one native
|
|
wolfSSL library instance is shared across all provider
|
|
objects by design.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLProvider"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD"/>
|
|
</Match>
|
|
|
|
<!--
|
|
CT_CONSTRUCTOR_THROW: JNI wrapper and JSSE class constructors
|
|
throw exceptions when native resource allocation fails (e.g.
|
|
native pointer returned as 0) or when invalid arguments are
|
|
provided. This is the standard Java idiom for signaling
|
|
construction failure. No native resources are leaked when
|
|
the exception is thrown since allocation had not yet
|
|
succeeded. Not vulnerable to finalizer attacks since the
|
|
native pointer is 0/null in the failure case.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfCryptEccKey"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCRL"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCertManager"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCertRequest"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCertificate"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLContext"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLNameConstraints"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLSession"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLX509Name"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLX509StoreCtx"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLAuthStore"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLEngineHelper"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLKeyX509"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLSNIServerName"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
|
|
<Method name="<init>"/>
|
|
<Bug pattern="CT_CONSTRUCTOR_THROW"/>
|
|
</Match>
|
|
|
|
<!--
|
|
IS2_INCONSISTENT_SYNC: Fields set in constructors before
|
|
object is published to other threads, then read under locks
|
|
afterward. Safe per Java Memory Model since constructor
|
|
completion happens-before publication.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCertificate"/>
|
|
<Field name="active"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCRL"/>
|
|
<Field name="active"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCertRequest"/>
|
|
<Field name="active"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLContext"/>
|
|
<Field name="sslCtxPtr"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLX509Name"/>
|
|
<Field name="x509NamePtr"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLX509Name"/>
|
|
<Field name="active"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
<!--
|
|
IS2_INCONSISTENT_SYNC: WolfSSLX509Name cached mirror fields.
|
|
Written by updateMirrorField() during DN-based construction
|
|
(before the object is published) and from synchronized
|
|
setXxx() methods after construction. Reads via synchronized
|
|
getXxx() methods. Safe under JMM publication semantics.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLX509Name"/>
|
|
<Or>
|
|
<Field name="countryName"/>
|
|
<Field name="stateOrProvinceName"/>
|
|
<Field name="streetAddress"/>
|
|
<Field name="localityName"/>
|
|
<Field name="surname"/>
|
|
<Field name="commonName"/>
|
|
<Field name="emailAddress"/>
|
|
<Field name="organizationName"/>
|
|
<Field name="organizationalUnitName"/>
|
|
<Field name="postalCode"/>
|
|
<Field name="userId"/>
|
|
<Field name="title"/>
|
|
<Field name="domainComponent"/>
|
|
<Field name="serialNumber"/>
|
|
</Or>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
|
|
<!--
|
|
IS2_INCONSISTENT_SYNC: WolfSSLSession callback context
|
|
fields and ctx. Getters use synchronized on 'this', setters
|
|
use synchronized(sslLock). These are set once during setup
|
|
and read from JNI callbacks. The ctx field is set in the
|
|
constructor before object publication.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLSession"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
|
|
<!--
|
|
IS2_INCONSISTENT_SYNC: WolfSSLEngine.ssl,
|
|
extraDebugEnabled, and ioDebugEnabled, and
|
|
WolfSSLSocket.ssl fields set in constructor (before
|
|
publication), unsynchronized reads only in debug logging
|
|
lambdas (read-only, non-critical).
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
|
|
<Field name="ssl"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
|
|
<Field name="extraDebugEnabled"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
|
|
<Field name="ioDebugEnabled"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
|
|
<Field name="ssl"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
|
|
<!--
|
|
IS2_INCONSISTENT_SYNC: WolfSSLParameters array-based
|
|
getters/setters (cipherSuites, protocols, applicationProtocols)
|
|
and copy() are synchronized. Remaining primitive
|
|
getters/setters (booleans, ints) are intentionally not
|
|
synchronized since primitive reads/writes are atomic and
|
|
objects are copied before sharing across threads.
|
|
-->
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLParameters"/>
|
|
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
|
|
</Match>
|
|
|
|
<!--
|
|
NM_METHOD_NAMING_CONVENTION: Public native JNI methods use
|
|
PascalCase to match native wolfSSL C function naming.
|
|
Renaming would break existing users and require updating
|
|
native JNI C code.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Bug pattern="NM_METHOD_NAMING_CONVENTION"/>
|
|
</Match>
|
|
|
|
<!--
|
|
MS_PKGPROTECT: Public API constants in WolfSSL documented
|
|
in Javadoc as values users pass to methods like
|
|
getExtensionSet(), setKeyUsage(), setPublicKey(), etc.
|
|
Reducing visibility would break users.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_surname"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_serialNumber"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_pkcs9_unstructuredName"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_pkcs9_contentType"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_pkcs9_challengePassword"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_givenName"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_initials"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_key_usage"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_subject_alt_name"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_basic_constraints"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_ext_key_usage"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="NID_dnQualifier"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="RSAk"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="ECDSAk"/>
|
|
<Bug pattern="MS_PKGPROTECT"/>
|
|
</Match>
|
|
|
|
<!--
|
|
FI_FINALIZER_NULLS_FIELDS: Finalizers null out fields as
|
|
defensive cleanup for JNI native resources. Nulling ensures
|
|
references to native pointers and shared objects don't
|
|
linger if something holds a reference to the finalized
|
|
object. The finalizers also do real work (freeSSL(),
|
|
store.clear()). Harmless and intentional.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLAuthStore"/>
|
|
<Method name="finalize"/>
|
|
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLContext"/>
|
|
<Method name="finalize"/>
|
|
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
|
|
<Method name="finalize"/>
|
|
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLEngineHelper"/>
|
|
<Method name="finalize"/>
|
|
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
|
|
<Method name="finalize"/>
|
|
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLTrustX509"/>
|
|
<Method name="finalize"/>
|
|
<Bug pattern="FI_FINALIZER_NULLS_FIELDS"/>
|
|
</Match>
|
|
|
|
<!--
|
|
PA_PUBLIC_PRIMITIVE_ATTRIBUTE: WolfSSLDebug public debug
|
|
flags are public API for users to check/control debug
|
|
logging at runtime.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLDebug"/>
|
|
<Field name="DEBUG"/>
|
|
<Bug pattern="PA_PUBLIC_PRIMITIVE_ATTRIBUTE"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLDebug"/>
|
|
<Field name="DEBUG_JNI"/>
|
|
<Bug pattern="PA_PUBLIC_PRIMITIVE_ATTRIBUTE"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLDebug"/>
|
|
<Field name="DEBUG_JSON"/>
|
|
<Bug pattern="PA_PUBLIC_PRIMITIVE_ATTRIBUTE"/>
|
|
</Match>
|
|
|
|
<!--
|
|
AT_STALE_THREAD_WRITE_OF_PRIMITIVE: WolfSSLParameters
|
|
objects are copied via copy() before being shared across
|
|
threads, providing the thread-safety boundary. Matching
|
|
the JDK SSLParameters pattern which also does not
|
|
synchronize primitive getters/setters.
|
|
|
|
WolfSSLImplementSSLSession.side is set once during setup
|
|
before the session is used across threads.
|
|
-->
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLParameters"/>
|
|
<Bug pattern="AT_STALE_THREAD_WRITE_OF_PRIMITIVE"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLImplementSSLSession"/>
|
|
<Field name="side"/>
|
|
<Bug pattern="AT_STALE_THREAD_WRITE_OF_PRIMITIVE"/>
|
|
</Match>
|
|
|
|
<!--
|
|
RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE: Defensive null
|
|
check on getSession() return value. The session could be
|
|
null depending on engine state, keeping as defensive check.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
|
|
<Method name="cacheRequestedServerNamesFromNetData"/>
|
|
<Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE"/>
|
|
</Match>
|
|
|
|
<!--
|
|
RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE: Defensive null check
|
|
on certPem in catch block after constructor threw. Kept as
|
|
defensive coding to free native resources if constructor
|
|
behavior changes in the future.
|
|
-->
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLTrustManager"/>
|
|
<Method name="LoadAndroidSystemCertsManually"/>
|
|
<Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE"/>
|
|
</Match>
|
|
|
|
<!--
|
|
DCN_NULLPOINTER_EXCEPTION: Intentional catch of
|
|
NullPointerException. close() uses it to detect calls from
|
|
super() before object init. I/O callbacks catch it
|
|
defensively when socket/stream may be nulled by another
|
|
thread during close. InputStream wraps it in IOException.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
|
|
<Method name="close"/>
|
|
<Bug pattern="DCN_NULLPOINTER_EXCEPTION"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLSocket$SocketSendCallback"/>
|
|
<Method name="sendCallback"/>
|
|
<Bug pattern="DCN_NULLPOINTER_EXCEPTION"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLSocket$SocketRecvCallback"/>
|
|
<Method name="receiveCallback"/>
|
|
<Bug pattern="DCN_NULLPOINTER_EXCEPTION"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLSocket$WolfSSLInputStream"/>
|
|
<Method name="read"/>
|
|
<Bug pattern="DCN_NULLPOINTER_EXCEPTION"/>
|
|
</Match>
|
|
|
|
<!--
|
|
REC_CATCH_EXCEPTION: WolfSSLParametersHelper uses reflection
|
|
for Java version compatibility. catch(Exception) is the
|
|
standard pattern for reflection calls that may throw
|
|
NoSuchMethodException, IllegalAccessException,
|
|
InvocationTargetException, ClassNotFoundException, etc.
|
|
on older Java versions where methods don't exist.
|
|
-->
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLParametersHelper"/>
|
|
<Bug pattern="REC_CATCH_EXCEPTION"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLParametersHelper$1"/>
|
|
<Bug pattern="REC_CATCH_EXCEPTION"/>
|
|
</Match>
|
|
|
|
<!--
|
|
DE_MIGHT_IGNORE: Same reflection compatibility code as
|
|
above. Exceptions are intentionally ignored when methods
|
|
don't exist on older Java versions.
|
|
-->
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLParametersHelper"/>
|
|
<Method name="decoupleParams"/>
|
|
<Bug pattern="DE_MIGHT_IGNORE"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name=
|
|
"com.wolfssl.provider.jsse.WolfSSLParametersHelper"/>
|
|
<Method name="importParams"/>
|
|
<Bug pattern="DE_MIGHT_IGNORE"/>
|
|
</Match>
|
|
|
|
<!--
|
|
VA_FORMAT_STRING_USES_NEWLINE: JSON format requires \n per
|
|
spec (not platform-specific %n). Hex dump formatting also
|
|
needs consistent \n across platforms.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLDebug$JSONFormatter"/>
|
|
<Method name="format"/>
|
|
<Bug pattern="VA_FORMAT_STRING_USES_NEWLINE"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLDebug"/>
|
|
<Method name="logHex"/>
|
|
<Bug pattern="VA_FORMAT_STRING_USES_NEWLINE"/>
|
|
</Match>
|
|
|
|
<!--
|
|
MS_CANNOT_BE_FINAL: WolfSSL.devId is intentionally mutable,
|
|
set at runtime by users via WolfSSLProvider.setDevId() to
|
|
configure crypto callback device ID.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSL"/>
|
|
<Field name="devId"/>
|
|
<Bug pattern="MS_CANNOT_BE_FINAL"/>
|
|
</Match>
|
|
|
|
<!--
|
|
ESync_EMPTY_SYNC: Empty synchronized block in close() is
|
|
intentional. Used to detect if close() is called from
|
|
super() constructor before WolfSSLSocket fields are
|
|
initialized. If handshakeLock is null (not yet init),
|
|
NPE is caught and TLS shutdown is skipped.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLSocket"/>
|
|
<Method name="close"/>
|
|
<Bug pattern="ESync_EMPTY_SYNC"/>
|
|
</Match>
|
|
|
|
<!--
|
|
ENV_USE_PROPERTY_INSTEAD_OF_ENV: getJavaHome() intentionally
|
|
checks JAVA_HOME env var first, then falls back to
|
|
java.home property. JAVA_HOME and java.home can point to
|
|
different locations (JDK root vs JRE within it).
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.provider.jsse.WolfSSLUtil"/>
|
|
<Method name="getJavaHome"/>
|
|
<Bug pattern="ENV_USE_PROPERTY_INSTEAD_OF_ENV"/>
|
|
</Match>
|
|
|
|
<!--
|
|
SE_TRANSIENT_FIELD_NOT_RESTORED: Lock fields in
|
|
WolfSSLCertificate and WolfSSLCRL are marked transient to
|
|
satisfy Android Gradle -Werror serialization warnings.
|
|
These classes are not actually serialized, so the fields
|
|
not being restored after deserialization is not a concern.
|
|
-->
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCertificate"/>
|
|
<Field name="stateLock"/>
|
|
<Bug pattern="SE_TRANSIENT_FIELD_NOT_RESTORED"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCertificate"/>
|
|
<Field name="x509Lock"/>
|
|
<Bug pattern="SE_TRANSIENT_FIELD_NOT_RESTORED"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCRL"/>
|
|
<Field name="stateLock"/>
|
|
<Bug pattern="SE_TRANSIENT_FIELD_NOT_RESTORED"/>
|
|
</Match>
|
|
<Match>
|
|
<Class name="com.wolfssl.WolfSSLCRL"/>
|
|
<Field name="crlLock"/>
|
|
<Bug pattern="SE_TRANSIENT_FIELD_NOT_RESTORED"/>
|
|
</Match>
|
|
|
|
</FindBugsFilter>
|