find-sec-bugs / find-sec-bugs

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

Home Page:https://find-sec-bugs.github.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Invalid class name exception for methods with generics

pavelorehov opened this issue · comments

As continue of #669 still fails with 1.12.0

fails on return value of method:
public Map<String, String> test1()

Full class example:

import java.util.Map;

import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class TestController {

	// fails
	/*
	 * [java] The following errors occurred during analysis:
     [java]   Exception analyzing TestController using detector com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector
     [java]     java.lang.IllegalArgumentException: Invalid class name java/lang/String;Ljava/lang/String
     [java]       At edu.umd.cs.findbugs.classfile.ClassDescriptor.<init>(ClassDescriptor.java:59)
     [java]       At edu.umd.cs.findbugs.classfile.DescriptorFactory.getClassDescriptor(DescriptorFactory.java:128)
     [java]       At edu.umd.cs.findbugs.AnalysisCacheToRepositoryAdapter.loadClass(AnalysisCacheToRepositoryAdapter.java:90)
     [java]       At org.apache.bcel.Repository.lookupClass(Repository.java:180)
     [java]       At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.typeToJavaClass(SignatureParserWithGeneric.java:75)
	 */
	@GetMapping(value = "/test1", produces = MediaType.APPLICATION_JSON_VALUE)
    public Map<String, String> test1() {
		return Map.of();
	}
	
	// work
	@GetMapping(value = "/test2", produces = MediaType.TEXT_PLAIN_VALUE)
    public String test2() {
		return "OK";
	}
}

@pavelorehov have you tried with 1.13.0 ?

Hi, yes, that issue got resolved with findsecbugs-plugin:1.13.0 and spotbugs-maven-plugin:4.8.3.1