Triage some SpotBugs violations (jenkinsci#6049)

core/src/main/java/hudson/ExtensionList.java

@@ -38,6 +38,7 @@
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Vector;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
@@ -327,7 +328,7 @@ private List<ExtensionComponent<T>> ensureLoaded() {
      * Chooses the object that locks the loading of the extension instances.
      */
     protected Object getLoadLock() {
-        return jenkins.lookup.setIfNull(Lock.class,new Lock());
+        return Objects.requireNonNull(jenkins).lookup.setIfNull(Lock.class,new Lock());
     }
 
     /**
@@ -379,7 +380,7 @@ protected List<ExtensionComponent<T>> load() {
             LOGGER.log(Level.FINER, String.format("Loading ExtensionList '%s' from", extensionType.getName()), new Throwable("Only present for stacktrace information"));
         }
 
-        return jenkins.getPluginManager().getPluginStrategy().findComponents(extensionType, hudson);
+        return Objects.requireNonNull(jenkins).getPluginManager().getPluginStrategy().findComponents(extensionType, hudson);
     }
 
     /**

core/src/main/java/hudson/WebAppMain.java

@@ -71,8 +71,6 @@
 import javax.servlet.ServletContextListener;
 import javax.servlet.ServletResponse;
 import javax.servlet.SessionTrackingMode;
-import javax.xml.transform.TransformerFactory;
-import javax.xml.transform.TransformerFactoryConfigurationError;
 import jenkins.model.Jenkins;
 import jenkins.util.JenkinsJVM;
 import jenkins.util.SystemProperties;
@@ -235,23 +233,6 @@ public Locale get() {
                 throw new NoTempDir(e);
             }
 
-            // Tomcat breaks XSLT with JDK 5.0 and onward. Check if that's the case, and if so,
-            // try to correct it
-            try {
-                TransformerFactory.newInstance();
-                // if this works we are all happy
-            } catch (TransformerFactoryConfigurationError x) {
-                // no it didn't.
-                LOGGER.log(WARNING, "XSLT not configured correctly. Hudson will try to fix this. See https://bz.apache.org/bugzilla/show_bug.cgi?id=40895 for more details",x);
-                System.setProperty(TransformerFactory.class.getName(),"com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl");
-                try {
-                    TransformerFactory.newInstance();
-                    LOGGER.info("XSLT is set to the JAXP RI in JRE");
-                } catch(TransformerFactoryConfigurationError y) {
-                    LOGGER.log(SEVERE, "Failed to correct the problem.");
-                }
-            }
-
             installExpressionFactory(event);
 
             context.setAttribute(APP,new HudsonIsLoading());

core/src/main/java/hudson/console/ConsoleNote.java

@@ -325,10 +325,12 @@ public static void skip(DataInputStream in) throws IOException {
      * Preamble of the encoded form. ANSI escape sequence to stop echo back
      * plus a few magic characters.
      */
+    @SuppressFBWarnings(value = "MS_PKGPROTECT", justification = "used in several plugins")
     public static final byte[] PREAMBLE = PREAMBLE_STR.getBytes();
     /**
      * Post amble is the ANSI escape sequence that brings back the echo.
      */
+    @SuppressFBWarnings(value = "MS_PKGPROTECT", justification = "used in several plugins")
     public static final byte[] POSTAMBLE = POSTAMBLE_STR.getBytes();
 
     /**

core/src/main/java/hudson/model/AbstractItem.java

@@ -353,6 +353,7 @@ protected void checkRename(@NonNull String newName) throws Failure {
      * Not all the Items need to support this operation, but if you decide to do so,
      * you can use this method.
      */
+    @SuppressFBWarnings(value = "SWL_SLEEP_WITH_LOCK_HELD", justification = "no big deal")
     protected void renameTo(final String newName) throws IOException {
 
         if (!isNameEditable()) {

core/src/main/java/hudson/model/AutoCompletionCandidates.java

@@ -25,6 +25,7 @@
 package hudson.model;
 
 import edu.umd.cs.findbugs.annotations.CheckForNull;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.search.Search;
 import hudson.search.UserSearchProperty;
 import java.io.IOException;
@@ -108,6 +109,7 @@ public static <T extends Item> AutoCompletionCandidates ofJobNames(final Class<T
      *      The nearby contextual {@link ItemGroup} to resolve relative job names from.
      * @since 1.553
      */
+    @SuppressFBWarnings(value = "SBSC_USE_STRINGBUFFER_CONCATENATION", justification = "no big deal")
     public static  <T extends Item> AutoCompletionCandidates ofJobNames(final Class<T> type, final String value, ItemGroup container) {
         final AutoCompletionCandidates candidates = new AutoCompletionCandidates();
         class Visitor extends ItemVisitor {

core/src/main/java/hudson/model/Cause.java

@@ -26,6 +26,7 @@
 import com.thoughtworks.xstream.converters.UnmarshallingContext;
 import edu.umd.cs.findbugs.annotations.CheckForNull;
 import edu.umd.cs.findbugs.annotations.NonNull;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Util;
 import hudson.console.ModelHyperlinkNote;
 import hudson.diagnosis.OldDataMonitor;
@@ -129,6 +130,7 @@ public void print(TaskListener listener) {
      */
     @Deprecated
     public static class LegacyCodeCause extends Cause {
+        @SuppressFBWarnings(value = "URF_UNREAD_FIELD", justification = "for backward compatibility")
         private StackTraceElement [] stackTrace;
         public LegacyCodeCause() {
             stackTrace = new Exception().getStackTrace();

core/src/main/java/hudson/model/DirectoryBrowserSupport.java

@@ -750,6 +750,7 @@ private static final class BuildChildPaths extends MasterToSlaveCallable<List<Li
      * list of {@link Path} represents one child item to be shown
      * (this mechanism is used to skip empty intermediate directory.)
      */
+    @SuppressFBWarnings(value = "SBSC_USE_STRINGBUFFER_CONCATENATION", justification = "no big deal")
     private static List<List<Path>> buildChildPaths(VirtualFile cur, Locale locale) throws IOException {
             List<List<Path>> r = new ArrayList<>();
 

core/src/main/java/hudson/model/FreeStyleProject.java

@@ -23,6 +23,7 @@
  */
 package hudson.model;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import jenkins.model.Jenkins;
 import jenkins.model.item_category.StandaloneProjectsCategory;
@@ -70,10 +71,12 @@ public DescriptorImpl getDescriptor() {
      */
     @Deprecated
     @Restricted(NoExternalUse.class)
+    @SuppressFBWarnings(value = "MS_PKGPROTECT", justification = "for backward compatibility")
     public static /*almost final*/ DescriptorImpl DESCRIPTOR;
 
     @Extension(ordinal=1000) @Symbol({"freeStyle","freeStyleJob"})
     public static class DescriptorImpl extends AbstractProjectDescriptor {
+        @SuppressFBWarnings(value = "ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD", justification = "for backward compatibility")
         public DescriptorImpl() {
             DESCRIPTOR = this;
         }

core/src/main/java/hudson/model/Queue.java

@@ -1370,6 +1370,7 @@ public static <V> java.util.concurrent.Callable<V> wrapWithLock(java.util.concur
     }
 
     @Override
+    @SuppressFBWarnings(value = "WA_AWAIT_NOT_IN_LOOP", justification = "the caller does indeed call this method in a loop")
     protected void _await() throws InterruptedException {
         condition.await();
     }

core/src/main/java/hudson/model/ResourceController.java

@@ -24,6 +24,7 @@
 package hudson.model;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.util.AdaptedIterator;
 import java.util.AbstractCollection;
 import java.util.Collection;
@@ -166,6 +167,7 @@ public ResourceActivity getBlockingActivity(ResourceActivity activity) {
         return null;
     }
 
+    @SuppressFBWarnings(value = "WA_NOT_IN_LOOP", justification = "the caller does indeed call this method in a loop")
     protected void _await() throws InterruptedException {
         wait();
     }

core/src/main/java/hudson/model/StringParameterDefinition.java

@@ -147,7 +147,7 @@ public String getHelpFile() {
     @Override
     public ParameterValue createValue(StaplerRequest req, JSONObject jo) {
         StringParameterValue value = req.bindJSON(StringParameterValue.class, jo);
-        if (isTrim() && value!=null) {
+        if (isTrim()) {
             value.doTrim();
         }
         value.setDescription(getDescription());

core/src/main/java/hudson/model/UpdateCenter.java

@@ -1240,6 +1240,7 @@ public void postValidate(DownloadJob job, File src) throws IOException {
          * @throws IOException if there were problems downloading the resource.
          * @see DownloadJob
          */
+        @SuppressFBWarnings(value = "WEAK_MESSAGE_DIGEST_SHA1", justification = "SHA-1 is only used as a fallback if SHA-256/SHA-512 are not available")
         public File download(DownloadJob job, URL src) throws IOException {
             MessageDigest sha1 = null;
             MessageDigest sha256 = null;

core/src/main/java/hudson/node_monitors/ClockMonitor.java

@@ -23,6 +23,7 @@
  */
 package hudson.node_monitors;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import hudson.model.Computer;
 import hudson.model.Node;
@@ -53,10 +54,12 @@ public ClockDifference getDifferenceFor(Computer c) {
      */
     @Deprecated
     @Restricted(NoExternalUse.class)
+    @SuppressFBWarnings(value = "MS_PKGPROTECT", justification = "for backward compatibility")
     public static /*almost final*/ AbstractNodeMonitorDescriptor<ClockDifference> DESCRIPTOR;
 
     @Extension @Symbol("clock")
     public static class DescriptorImpl extends AbstractAsyncNodeMonitorDescriptor<ClockDifference> {
+        @SuppressFBWarnings(value = "ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD", justification = "for backward compatibility")
         public DescriptorImpl() {
             DESCRIPTOR = this;
         }

core/src/main/java/hudson/node_monitors/SwapSpaceMonitor.java

@@ -23,6 +23,7 @@
  */
 package hudson.node_monitors;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import hudson.Functions;
 import hudson.Util;
@@ -89,6 +90,7 @@ public String getColumnCaption() {
 
     @Extension @Symbol("swapSpace")
     public static class DescriptorImpl extends AbstractAsyncNodeMonitorDescriptor<MemoryUsage> {
+        @SuppressFBWarnings(value = "ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD", justification = "for backward compatibility")
         public DescriptorImpl() {
             DESCRIPTOR = this;
         }

core/src/main/java/hudson/node_monitors/TemporarySpaceMonitor.java

@@ -23,6 +23,7 @@
  */
 package hudson.node_monitors;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import hudson.FilePath;
 import hudson.model.Computer;
@@ -66,10 +67,12 @@ public String getColumnCaption() {
      *      Use injection
      */
     @Deprecated
+    @SuppressFBWarnings(value = "MS_PKGPROTECT", justification = "for backward compatibility")
     public static /*almost final*/ DiskSpaceMonitorDescriptor DESCRIPTOR;
 
     @Extension @Symbol("tmpSpace")
     public static class DescriptorImpl extends DiskSpaceMonitorDescriptor {
+        @SuppressFBWarnings(value = "ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD", justification = "for backward compatibility")
         public DescriptorImpl() {
             DESCRIPTOR = this;
         }

core/src/main/java/hudson/security/ACL.java

@@ -355,7 +355,7 @@ public String toString() {
      */
     public static final Sid ANONYMOUS = new PrincipalSid(ANONYMOUS_USERNAME);
 
-    protected static final Sid[] AUTOMATIC_SIDS = new Sid[]{EVERYONE,ANONYMOUS};
+    static final Sid[] AUTOMATIC_SIDS = new Sid[]{EVERYONE,ANONYMOUS};
 
     /**
      * The username for the system user

core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java

@@ -23,6 +23,7 @@
  */
 package hudson.security;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import hudson.model.Descriptor;
 import java.util.Collections;
@@ -96,6 +97,7 @@ public void setAllowAnonymousRead(boolean allowAnonymousRead) {
 
     @Extension @Symbol("loggedInUsersCanDoAnything")
     public static class DescriptorImpl extends Descriptor<AuthorizationStrategy> {
+        @SuppressFBWarnings(value = "ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD", justification = "for backward compatibility")
         public DescriptorImpl() {
             DESCRIPTOR = this;
         }

core/src/main/java/hudson/security/LegacySecurityRealm.java

@@ -23,6 +23,7 @@
  */
 package hudson.security;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import hudson.model.Descriptor;
 import java.util.ArrayList;
@@ -99,6 +100,7 @@ public Filter createFilter(FilterConfig filterConfig) {
 
     @Extension @Symbol("legacy")
     public static class DescriptorImpl extends  Descriptor<SecurityRealm> {
+        @SuppressFBWarnings(value = "ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD", justification = "for backward compatibility")
         public DescriptorImpl() {
             DESCRIPTOR = this;
         }

core/src/main/java/hudson/slaves/JNLPLauncher.java

@@ -202,6 +202,7 @@ public String getWorkDirOptions(@NonNull Computer computer) {
 
     @Extension @Symbol("jnlp")
     public static class DescriptorImpl extends Descriptor<ComputerLauncher> {
+        @SuppressFBWarnings(value = "ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD", justification = "for backward compatibility")
         public DescriptorImpl() {
             DESCRIPTOR = this;
         }

core/src/main/java/hudson/tasks/Maven.java

@@ -429,6 +429,7 @@ public static final class DescriptorImpl extends BuildStepDescriptor<Builder> im
         @CopyOnWrite
         private volatile MavenInstallation[] installations = new MavenInstallation[0];
 
+        @SuppressFBWarnings(value = "ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD", justification = "for backward compatibility")
         public DescriptorImpl() {
             DESCRIPTOR = this;
         }

core/src/main/java/hudson/triggers/SCMTrigger.java

@@ -62,6 +62,7 @@
 import java.util.Date;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -209,7 +210,7 @@ public Collection<? extends Action> getProjectActions() {
      * Returns the file that records the last/current polling activity.
      */
     public File getLogFile() {
-        return new File(job.getRootDir(),"scm-polling.log");
+        return new File(Objects.requireNonNull(job).getRootDir(),"scm-polling.log");
     }
 
     @Extension @Symbol("pollSCM")
@@ -691,7 +692,7 @@ public boolean equals(Object that) {
 
         @Override
         public int hashCode() {
-            return job.hashCode();
+            return Objects.requireNonNull(job).hashCode();
         }
     }
 

core/src/main/java/hudson/util/ProcessTree.java

@@ -2242,6 +2242,6 @@ public <T> T act(ProcessCallable<T> callable) throws IOException, InterruptedExc
      * in case there's a fatal problem.
      *
      */
-    public static boolean enabled = !SystemProperties.getBoolean("hudson.util.ProcessTreeKiller.disable")
+    static boolean enabled = !SystemProperties.getBoolean("hudson.util.ProcessTreeKiller.disable")
             && !SystemProperties.getBoolean(ProcessTree.class.getName()+".disable");
 }

core/src/main/java/hudson/util/RemotingDiagnostics.java

@@ -24,6 +24,7 @@
 package hudson.util;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import groovy.lang.Binding;
 import groovy.lang.GroovyShell;
 import hudson.FilePath;
@@ -127,6 +128,7 @@ public ClassLoader getClassLoader() {
         }
 
         @Override
+        @SuppressFBWarnings(value = "GROOVY_SHELL", justification = "script console is a feature, not a bug")
         public String call() throws RuntimeException {
             // if we run locally, cl!=null. Otherwise the delegating classloader will be available as context classloader.
             if (cl==null)       cl = Thread.currentThread().getContextClassLoader();

core/src/main/java/hudson/util/jna/Advapi32.java

@@ -31,6 +31,7 @@
  *
  * @author TB
  */
+@SuppressFBWarnings(value = "MS_OOI_PKGPROTECT", justification = "for backward compatibility")
 @SuppressWarnings("UnusedReturnValue")
 public interface Advapi32  extends StdCallLibrary {
   Advapi32 INSTANCE = (Advapi32) Native.load("Advapi32", Advapi32.class, Options.UNICODE_OPTIONS);

core/src/main/java/hudson/util/jna/Options.java

@@ -20,13 +20,15 @@
 
 import com.sun.jna.win32.W32APIFunctionMapper;
 import com.sun.jna.win32.W32APITypeMapper;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.util.HashMap;
 import java.util.Map;
 
 /**
  *
  * @author TB
  */
+@SuppressFBWarnings(value = "MS_OOI_PKGPROTECT", justification = "for backward compatibility")
 public interface Options {
   Map<String, Object> UNICODE_OPTIONS = new HashMap<String, Object>() {
     {

core/src/main/java/jenkins/fingerprints/FileFingerprintStorage.java

@@ -26,6 +26,7 @@
 import com.thoughtworks.xstream.converters.basic.DateConverter;
 import edu.umd.cs.findbugs.annotations.CheckForNull;
 import edu.umd.cs.findbugs.annotations.NonNull;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import hudson.Functions;
 import hudson.Util;
@@ -325,6 +326,7 @@ private static String messageOfParseException(Throwable throwable) {
     /**
      * Deletes a directory if it's empty.
      */
+    @SuppressFBWarnings(value = "RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE", justification = "https://github.com/spotbugs/spotbugs/issues/756")
     private void deleteIfEmpty(File dir) {
         try {
             if (Files.isDirectory(dir.toPath())) {

core/src/main/java/jenkins/install/SetupWizard.java

@@ -749,6 +749,7 @@ public void init(FilterConfig cfg) throws ServletException {
         }
 
         @Override
+        @SuppressFBWarnings(value = "UNVALIDATED_REDIRECT", justification = "TODO needs triage")
         public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
             // Force root requests to the setup wizard
             if (request instanceof HttpServletRequest && !Jenkins.get().getInstallState().isSetupComplete()) {