findbugs-excludes.xml

<?xml version="1.0" encoding="ISO-8859-1" ?>
<FindBugsFilter>
  <!-- Unchecked casts in these situations are okay: ClassCastException is appropriate -->
  <Match>
    <Or>
      <And>
        <Class name="net.christopherschultz.ssltest.SSLUtils$CustomSSLSocketFactory" />
        <Method name="customize" />
      </And>
      <And>
        <Class name="net.christopherschultz.ssltest.SSLTest" />
        <Method name="createSSLSocket" />
      </And>
    </Or>
    <Or>
      <Bug pattern="BC_UNCONFIRMED_CAST" />
      <Bug pattern="BC_UNCONFIRMED_CAST_OF_RETURN_VALUE" />
    </Or>
  </Match>

  <!-- Checking the return value from InetAddress.getAllByName for null is appropriate. -->
  <Match>
    <Class name="net.christopherschultz.ssltest.SSLTest" />
    <Method name="main" />
    <Local name="iaddrs" />
    <Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE" />
  </Match>

  <!-- It's okay to load files on behalf of the user. That's the whole point. -->
  <Match>
    <Class name="net.christopherschultz.ssltest.SSLUtils" />
    <Or>
      <Method name="getCRLs" />
      <Method name="getStore" />
    </Or>
    <Bug pattern="PATH_TRAVERSAL_IN" />
  </Match>

  <!-- TrustAllTrustManager is intended to be a "weak" TrustManager. -->
  <Match>
    <Class name="net.christopherschultz.ssltest.SSLUtils$TrustAllTrustManager" />
    <Bug pattern="WEAK_TRUST_MANAGER" />
  </Match>

  <!-- VerifyAllHostnameVerifier is intended to be a "weak" hostname verifier. -->
  <Match>
    <Class name="net.christopherschultz.ssltest.SSLUtils$VerifyAllHostnameVerifier" />
    <Bug pattern="WEAK_HOSTNAME_VERIFIER" />
  </Match>

  <!-- SSLTest.createSSLSocket first creates a non-encrypted socket, then adds encryption to it. -->
  <Match>
    <Class name="net.christopherschultz.ssltest.SSLTest" />
    <Method name="createSSLSocket" />
    <Bug pattern="UNENCRYPTED_SOCKET" />
  </Match>

  <!-- Having these methods accept Socket instead of SSLSocket makes for cleaner code. -->
  <Match>
    <Or>
      <Class name="net.christopherschultz.ssltest.SSLUtils$CustomSSLSocketFactory" />
    </Or>
    <Method name="customize" />
    <Bug pattern="PDP_POORLY_DEFINED_PARAMETER" />
  </Match>

  <!-- It's okay to dump stack traces to the console. -->
  <Match>
    <Class name="net.christopherschultz.ssltest.SSLTest" />
    <Method name="main" />
    <Bug pattern="IMC_IMMATURE_CLASS_PRINTSTACKTRACE" />
  </Match>

  <!-- It's okay that everything happens in the main() method. -->
  <Match>
    <Class name="net.christopherschultz.ssltest.SSLTest" />
    <Method name="main" />
    <Bug pattern="CC_CYCLOMATIC_COMPLEXITY" />
  </Match>

  <!-- getCRLs is intended to be a library method, and should be public. -->
  <Match>
    <Class name="net.christopherschultz.ssltest.SSLUtils" />
    <Method name="getCRLs" />
    <Bug pattern="OPM_OVERLY_PERMISSIVE_METHOD" />
  </Match>
</FindBugsFilter>