SDK-2262: Update spotbugs config

getyoti · Jul 25, 2023 · bae4f9a · bae4f9a
1 parent 1618e00
commit bae4f9a
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 0 deletions.
diff --git a/pom.xml b/pom.xml
@@ -56,6 +56,10 @@
         </executions>
       </plugin>
 
+      <plugin>
+        <groupId>com.github.spotbugs</groupId>
+        <artifactId>spotbugs-maven-plugin</artifactId>
+      </plugin>
     </plugins>
   </build>
 

diff --git a/yoti-sdk-api/spotbugs/exclude-filter.xml b/yoti-sdk-api/spotbugs/exclude-filter.xml
@@ -11,6 +11,12 @@
     <Package name="com.yoti.api.client.spi.remote.proto"/>
   </Match>
 
+  <!-- The IV comes from a trusted source  -->
+  <Match>
+    <Class name="com.yoti.api.client.spi.remote.call.identity.ReceiptItemKey$Builder"/>
+    <Bug pattern="STATIC_IV"/>
+  </Match>
+
   <!-- Legacy exclusions -->
   <Match>
     <Bug pattern="CRLF_INJECTION_LOGS"/>

diff --git a/yoti-sdk-spring-boot-auto-config/spotbugs/exclude-filter.xml b/yoti-sdk-spring-boot-auto-config/spotbugs/exclude-filter.xml
@@ -2,6 +2,10 @@
 
 <FindBugsFilter>
 
+  <!-- These patterns became completely broken after 4.3 - ignored them -->
+  <!-- See https://github.com/spotbugs/spotbugs/issues/1797 -->
+  <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
+
   <Match>
     <Bug pattern="CRLF_INJECTION_LOGS"/>
   </Match>

diff --git a/yoti-sdk-spring-boot-example/pom.xml b/yoti-sdk-spring-boot-example/pom.xml
@@ -106,13 +106,19 @@
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-maven-plugin</artifactId>
       </plugin>
+
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-deploy-plugin</artifactId>
         <configuration>
           <skip>true</skip>
         </configuration>
       </plugin>
+
+      <plugin>
+        <groupId>com.github.spotbugs</groupId>
+        <artifactId>spotbugs-maven-plugin</artifactId>
+      </plugin>
     </plugins>
   </build>