Fix for false positives EI_EXPOSE_REP in case of unmodifiable collections

CHANGELOG.md

@@ -7,6 +7,7 @@ Currently the versioning policy of this project follows [Semantic Versioning v2.
 ## Unreleased - 2022-??-??
 ### Fixed
 - Fixed InvalidInputException in Eclipse while bug reporting ([#2134](https://github.com/spotbugs/spotbugs/issues/2134))
+- Fixed false positives `EI_EXPORES_REP` thrown in case of fields initialized by the `of` or `copyOf` method of a `List`, `Map` or `Set` ([#1771](https://github.com/spotbugs/spotbugs/issues/1771))
 
 ## 4.7.1 - 2022-06-26
 ### Fixed

spotbugs-tests/src/test/java/edu/umd/cs/findbugs/detect/Issue1771Test.java

@@ -0,0 +1,32 @@
+package edu.umd.cs.findbugs.detect;
+
+import org.junit.Before;
+import org.junit.Test;
+
+import edu.umd.cs.findbugs.AbstractIntegrationTest;
+import edu.umd.cs.findbugs.test.matcher.BugInstanceMatcher;
+import edu.umd.cs.findbugs.test.matcher.BugInstanceMatcherBuilder;
+
+import static edu.umd.cs.findbugs.test.CountMatcher.containsExactly;
+import static org.junit.Assume.assumeFalse;
+import static org.junit.Assume.assumeThat;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
+
+public class Issue1771Test extends AbstractIntegrationTest {
+    @Before
+    public void verifyJavaVersion() {
+        assumeFalse(System.getProperty("java.specification.version").startsWith("1."));
+        int javaVersion = Integer.parseInt(System.getProperty("java.specification.version"));
+        assumeThat(javaVersion, is(greaterThanOrEqualTo(11)));
+    }
+
+    @Test
+    public void test() {
+        performAnalysis("../java11/ghIssues/Issue1771.class");
+        BugInstanceMatcher matcher = new BugInstanceMatcherBuilder()
+                .bugType("EI_EXPOSE_REP").build();
+        assertThat(getBugCollection(), containsExactly(0, matcher));
+    }
+}

spotbugs/src/main/java/edu/umd/cs/findbugs/OpcodeStack.java

@@ -124,6 +124,9 @@ public class OpcodeStack {
     }
 
     private static final String JAVA_UTIL_ARRAYS_ARRAY_LIST = "Ljava/util/Arrays$ArrayList;";
+    private static final String JAVA_UTIL_IMMUTABLECOLLECTIONS_ABSTRACTIMMUTABLELIST = "Ljava/util/ImmutableCollections$AbstractImmutableList;";
+    private static final String JAVA_UTIL_IMMUTABLECOLLECTIONS_ABSTRACTIMMUTABLEMAP = "Ljava/util/ImmutableCollections$AbstractImmutableMap;";
+    private static final String JAVA_UTIL_IMMUTABLECOLLECTIONS_ABSTRACTIMMUTABLESET = "Ljava/util/ImmutableCollections$AbstractImmutableSet;";
 
     private static final boolean DEBUG = SystemProperties.getBoolean("ocstack.debug");
 
@@ -2633,6 +2636,36 @@ private void processMethodCall(DismantleBytecode dbc, int seen) {
                 return;
             }
             push(requestParameter); // fall back to standard logic
+        } else if (seen == Const.INVOKESTATIC &&
+                ("of".equals(methodName) || "copyOf".equals(methodName)) &&
+                "java/util/List".equals(clsName)) {
+            SignatureParser sp = new SignatureParser(signature);
+            for (int i = 0; i < sp.getNumParameters(); ++i) {
+                pop();
+            }
+            Item result = new Item(JAVA_UTIL_IMMUTABLECOLLECTIONS_ABSTRACTIMMUTABLELIST);
+            push(result);
+            return;
+        } else if (seen == Const.INVOKESTATIC &&
+                ("of".equals(methodName) || "copyOf".equals(methodName)) &&
+                "java/util/Map".equals(clsName)) {
+            SignatureParser sp = new SignatureParser(signature);
+            for (int i = 0; i < sp.getNumParameters(); ++i) {
+                pop();
+            }
+            Item result = new Item(JAVA_UTIL_IMMUTABLECOLLECTIONS_ABSTRACTIMMUTABLEMAP);
+            push(result);
+            return;
+        } else if (seen == Const.INVOKESTATIC &&
+                ("of".equals(methodName) || "copyOf".equals(methodName)) &&
+                "java/util/Set".equals(clsName)) {
+            SignatureParser sp = new SignatureParser(signature);
+            for (int i = 0; i < sp.getNumParameters(); ++i) {
+                pop();
+            }
+            Item result = new Item(JAVA_UTIL_IMMUTABLECOLLECTIONS_ABSTRACTIMMUTABLESET);
+            push(result);
+            return;
         }
 
         pushByInvoke(dbc, seen != Const.INVOKESTATIC);

spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindReturnRef.java

@@ -36,6 +36,7 @@
 import edu.umd.cs.findbugs.OpcodeStack;
 import edu.umd.cs.findbugs.ba.AnalysisContext;
 import edu.umd.cs.findbugs.ba.XField;
+import edu.umd.cs.findbugs.ba.type.TypeFrameModelingVisitor;
 import edu.umd.cs.findbugs.classfile.CheckedAnalysisException;
 import edu.umd.cs.findbugs.classfile.ClassDescriptor;
 import edu.umd.cs.findbugs.bcel.OpcodeStackDetector;
@@ -196,7 +197,7 @@ public void sawOpcode(int seen) {
                     field.isPublic() ||
                     AnalysisContext.currentXFactory().isEmptyArrayField(field) ||
                     field.getName().indexOf("EMPTY") != -1 ||
-                    !MutableClasses.mutableSignature(field.getSignature())) {
+                    !MutableClasses.mutableSignature(TypeFrameModelingVisitor.getType(field).getSignature())) {
                 return;
             }
             bugAccumulator.accumulateBug(new BugInstance(this, (staticMethod ? "MS" : "EI") + "_EXPOSE_"

spotbugs/src/main/java/edu/umd/cs/findbugs/util/MutableClasses.java

@@ -39,7 +39,10 @@ public class MutableClasses {
             "com.google.common.collect.ImmutableSortedMap",
             "com.google.common.collect.ImmutableSortedMultiset",
             "com.google.common.collect.ImmutableSortedSet",
-            "com.google.common.collect.ImmutableTable"));
+            "com.google.common.collect.ImmutableTable",
+            "java.util.ImmutableCollections$AbstractImmutableList",
+            "java.util.ImmutableCollections$AbstractImmutableMap",
+            "java.util.ImmutableCollections$AbstractImmutableSet"));
 
     private static final Set<String> KNOWN_IMMUTABLE_PACKAGES = new HashSet<>(Arrays.asList(
             "java.math", "java.time"));

spotbugsTestCases/src/java11/Issue1771.java

@@ -0,0 +1,49 @@
+package ghIssues;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+public class Issue1771 {
+    public Issue1771(List<String> list, Map<String, String> map, Set<String> set) {
+        this.list = List.copyOf(list);
+        this.map = Map.copyOf(map);
+        this.set = Set.copyOf(set);
+
+        list2 = List.of("foo", "bar");
+        map2 = Map.of("FOO", "foo", "BAR", "bar");
+        set2 = Set.of("foo", "bar");
+    }
+
+    private final List<String> list;
+    private final Map<String, String> map;
+    private final Set<String> set;
+
+    private final List<String> list2;
+    private final Map<String, String> map2;
+    private final Set<String> set2;
+
+    public List<String> getList() {
+        return list;
+    }
+
+    public Map<String, String> getMap() {
+        return map;
+    }
+
+    public Set<String> getSet() {
+        return set;
+    }
+
+    public List<String> getList2() {
+        return list2;
+    }
+
+    public Map<String, String> getMap2() {
+        return map2;
+    }
+
+    public Set<String> getSet2() {
+        return set2;
+    }
+}