How to use findbugs @Nonnull with external libraries?

Question

I started using findbugs @Nonnull and @CheckForNull annotations on an existing Project, to prevent NPEs, and think it works quite nice. I use @Nonnull as default for return types and parameters and found already a few NPEs, just by adding the default values. Now I found a method similar to this:

@Nonnull
private Integer getInteger(String key) {
    return Map.get(key);
}

And it does not produce a warning. I understand why this is the case, but how can I get around this? How do you work around this in your projects?

A solution that can be globally applied would be preferred, e.g. something like @ApplyCheckForNullToAllExternalCalls.

Answer 1

You can apply @CheckForNull to all method return values (and/or parameters) within a package by adding the annotation to the package's package-info.java file, but you won't have control over individual methods.

First, create @ReturnValuesAreCheckForNullByDefault in a utility package of your project.

@Documented
@CheckForNull
@TypeQualifierDefault(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface ReturnValuesAreCheckForNullByDefault { /* noop */ }

Next, create src/java/util/package-info.java.

@ReturnValuesAreCheckForNullByDefault
package java.util;

import my.project.util.ReturnValuesAreCheckForNullByDefault;

Finally, enjoy your FindBugs warnings.

@Nonnull
public String getValue() {
    Map<String, String> values = new HashMap<>();
    return values.get("foo");    // <-- Possible null pointer dereference ...
}

The problem with doing this is that there are many methods in the java.* packages that contractually do not return null. Using these without checking for null will raise warnings. For example, this NPE-safe code also raises a warning:

@Nonnull
public Set<String> getNotNull() {
    Map<String, String> values = new HashMap<>();
    return values.keySet();
}

You can suppress the warning with @SuppressFBWarnings, but this may clutter up the code too much for your liking.