From ced25e51fd201ec3ae7ae9d3e9262e573cf11e27 Mon Sep 17 00:00:00 2001
From: Jeff Thompson <jeffret.g@gmail.com>
Date: Mon, 2 Dec 2019 15:29:45 -0700
Subject: [PATCH] Make sure everything has a justification.

And move a couple of items to the exclude file. If we ever get to a lower threshold, these will show up all over the place.
---
 .../hudson/cli/DiagnosedStreamCorruptionException.java    | 3 ---
 core/src/main/java/hudson/Proc.java                       | 2 +-
 core/src/main/java/hudson/console/AnnotatedLargeText.java | 2 +-
 core/src/main/java/hudson/console/ConsoleNote.java        | 2 +-
 .../java/hudson/security/BasicAuthenticationFilter.java   | 2 +-
 .../hudson/security/HudsonAuthenticationEntryPoint.java   | 2 +-
 core/src/main/java/hudson/util/DOSToUnixPathHelper.java   | 4 ++--
 core/src/main/java/hudson/util/FormFieldValidator.java    | 2 +-
 .../main/java/jenkins/slaves/JnlpSlaveAgentProtocol4.java | 2 +-
 src/findbugs/findbugs-excludes.xml                        | 8 ++++++++
 10 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/cli/src/main/java/hudson/cli/DiagnosedStreamCorruptionException.java b/cli/src/main/java/hudson/cli/DiagnosedStreamCorruptionException.java
index c7d3963f3b..4708b425db 100644
--- a/cli/src/main/java/hudson/cli/DiagnosedStreamCorruptionException.java
+++ b/cli/src/main/java/hudson/cli/DiagnosedStreamCorruptionException.java
@@ -1,7 +1,5 @@
 package hudson.cli;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
 import java.io.PrintWriter;
 import java.io.StreamCorruptedException;
 import java.io.StringWriter;
@@ -13,7 +11,6 @@ import java.io.StringWriter;
  *
  * @author Kohsuke Kawaguchi
  */
-@SuppressFBWarnings(value = "INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE")
 class DiagnosedStreamCorruptionException extends StreamCorruptedException {
     private final Exception diagnoseFailure;
     private final byte[] readBack;
diff --git a/core/src/main/java/hudson/Proc.java b/core/src/main/java/hudson/Proc.java
index d134d0b8b7..f387d6abcc 100644
--- a/core/src/main/java/hudson/Proc.java
+++ b/core/src/main/java/hudson/Proc.java
@@ -216,7 +216,7 @@ public abstract class Proc {
          * @param err
          *      null to redirect stderr to stdout.
          */
-        @SuppressFBWarnings("COMMAND_INJECTION")
+        @SuppressFBWarnings(value = "COMMAND_INJECTION", justification = "Command injection is the point of this old, barely used class.")
         public LocalProc(String[] cmd,String[] env,InputStream in,OutputStream out,OutputStream err,File workDir) throws IOException {
             this( calcName(cmd),
                   stderr(environment(new ProcessBuilder(cmd),env).directory(workDir), err==null || err== SELFPUMP_OUTPUT),
diff --git a/core/src/main/java/hudson/console/AnnotatedLargeText.java b/core/src/main/java/hudson/console/AnnotatedLargeText.java
index 278c32c9a1..9625a8609f 100644
--- a/core/src/main/java/hudson/console/AnnotatedLargeText.java
+++ b/core/src/main/java/hudson/console/AnnotatedLargeText.java
@@ -117,7 +117,7 @@ public class AnnotatedLargeText<T> extends LargeText {
         rsp.setContentType(isHtml() ? "text/html;charset=UTF-8" : "text/plain;charset=UTF-8");
     }
 
-    @SuppressFBWarnings(value = "OBJECT_DESERIALIZATION")
+    @SuppressFBWarnings(value = "OBJECT_DESERIALIZATION", justification = "Deserialization is protected by logic.")
     private ConsoleAnnotator<T> createAnnotator(StaplerRequest req) throws IOException {
         try {
             String base64 = req!=null ? req.getHeader("X-ConsoleAnnotator") : null;
diff --git a/core/src/main/java/hudson/console/ConsoleNote.java b/core/src/main/java/hudson/console/ConsoleNote.java
index c8dd1675fe..82ca8365e7 100644
--- a/core/src/main/java/hudson/console/ConsoleNote.java
+++ b/core/src/main/java/hudson/console/ConsoleNote.java
@@ -233,7 +233,7 @@ public abstract class ConsoleNote<T> implements Serializable, Describable<Consol
      *
      * @return null if the encoded form is malformed.
      */
-    @SuppressFBWarnings(value = "OBJECT_DESERIALIZATION")
+    @SuppressFBWarnings(value = "OBJECT_DESERIALIZATION", justification = "Deserialization is protected by logic.")
     public static ConsoleNote readFrom(DataInputStream in) throws IOException, ClassNotFoundException {
         try {
             byte[] preamble = new byte[PREAMBLE.length];
diff --git a/core/src/main/java/hudson/security/BasicAuthenticationFilter.java b/core/src/main/java/hudson/security/BasicAuthenticationFilter.java
index 4ec0b8fa7e..b17e9ad280 100644
--- a/core/src/main/java/hudson/security/BasicAuthenticationFilter.java
+++ b/core/src/main/java/hudson/security/BasicAuthenticationFilter.java
@@ -98,7 +98,7 @@ public class BasicAuthenticationFilter implements Filter {
     }
 
     @SuppressWarnings("ACL.impersonate")
-    @SuppressFBWarnings(value = "UNVALIDATED_REDIRECT")
+    @SuppressFBWarnings(value = "UNVALIDATED_REDIRECT", justification = "Redirect is validated as processed.")
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
         HttpServletRequest req = (HttpServletRequest) request;
         HttpServletResponse rsp = (HttpServletResponse) response;
diff --git a/core/src/main/java/hudson/security/HudsonAuthenticationEntryPoint.java b/core/src/main/java/hudson/security/HudsonAuthenticationEntryPoint.java
index 7d6d57bf41..4c1ab5a98d 100644
--- a/core/src/main/java/hudson/security/HudsonAuthenticationEntryPoint.java
+++ b/core/src/main/java/hudson/security/HudsonAuthenticationEntryPoint.java
@@ -61,7 +61,7 @@ import java.text.MessageFormat;
  */
 public class HudsonAuthenticationEntryPoint extends AuthenticationProcessingFilterEntryPoint {
     @Override
-    @SuppressFBWarnings(value = "XSS_SERVLET")
+    @SuppressFBWarnings(value = "XSS_SERVLET", justification = "Interemediate step for redirecting users to login page.")
     public void commence(ServletRequest request, ServletResponse response, AuthenticationException reason) throws IOException, ServletException {
         HttpServletRequest req = (HttpServletRequest) request;
         HttpServletResponse rsp = (HttpServletResponse) response;
diff --git a/core/src/main/java/hudson/util/DOSToUnixPathHelper.java b/core/src/main/java/hudson/util/DOSToUnixPathHelper.java
index ab49acb693..274fd35f9c 100644
--- a/core/src/main/java/hudson/util/DOSToUnixPathHelper.java
+++ b/core/src/main/java/hudson/util/DOSToUnixPathHelper.java
@@ -17,7 +17,7 @@ class DOSToUnixPathHelper {
         void error(String string);
         void validate(File fexe);
     }
-    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN")
+    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "Limited use for locating shell executable by administrator.")
     static private boolean checkPrefix(String prefix, Helper helper) {
         File f = new File(prefix);
         if(f.exists()) {
@@ -32,7 +32,7 @@ class DOSToUnixPathHelper {
         }
         return false;
     }
-    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN")
+    @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "Limited use for locating shell executable by administrator.")
     static void iteratePath(String exe, Helper helper) {
         exe = fixEmpty(exe);
         if(exe==null) {
diff --git a/core/src/main/java/hudson/util/FormFieldValidator.java b/core/src/main/java/hudson/util/FormFieldValidator.java
index 09f9955655..2c53937ebb 100644
--- a/core/src/main/java/hudson/util/FormFieldValidator.java
+++ b/core/src/main/java/hudson/util/FormFieldValidator.java
@@ -320,7 +320,7 @@ public abstract class FormFieldValidator {
             super(request, response);
         }
 
-        @SuppressFBWarnings(value = "URLCONNECTION_SSRF_FD")
+        @SuppressFBWarnings(value = "URLCONNECTION_SSRF_FD", justification = "Not used.")
         protected void check() throws IOException, ServletException {
             String value = fixEmpty(request.getParameter("value"));
             if(value==null) {// nothing entered yet
diff --git a/core/src/main/java/jenkins/slaves/JnlpSlaveAgentProtocol4.java b/core/src/main/java/jenkins/slaves/JnlpSlaveAgentProtocol4.java
index 8e3f595999..c768f3ca15 100644
--- a/core/src/main/java/jenkins/slaves/JnlpSlaveAgentProtocol4.java
+++ b/core/src/main/java/jenkins/slaves/JnlpSlaveAgentProtocol4.java
@@ -99,7 +99,7 @@ public class JnlpSlaveAgentProtocol4 extends AgentProtocol {
      * @throws KeyManagementException if things go wrong.
      * @throws IOException            if things go wrong.
      */
-    @SuppressFBWarnings("HARD_CODE_PASSWORD")
+    @SuppressFBWarnings(value = "HARD_CODE_PASSWORD", justification = "Password doesn't need to be protected.")
     public JnlpSlaveAgentProtocol4() throws KeyStoreException, KeyManagementException, IOException {
         // prepare our local identity and certificate
         X509Certificate identityCertificate = InstanceIdentityProvider.RSA.getCertificate();
diff --git a/src/findbugs/findbugs-excludes.xml b/src/findbugs/findbugs-excludes.xml
index 665871ffd1..b7e091076a 100644
--- a/src/findbugs/findbugs-excludes.xml
+++ b/src/findbugs/findbugs-excludes.xml
@@ -13,4 +13,12 @@
       <Bug pattern="RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE"/>
     </Or>
   </Match>
+  <Match>
+    <!--We don't care about this behavior.-->
+    <Bug pattern="CRLF_INJECTION_LOGS"/>
+  </Match>
+  <Match>
+    <!--Jenkins handles this issue differently or doesn't care about it.-->
+    <Bug pattern="INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE"/>
+  </Match>
 </FindBugsFilter>