Handle null expectedMessage in InternalCheckVerifier

[sonarqube-agent]

This PR was automatically created by the Remediation Agent's Scheduled backlog remediation feature.

Why these issues? Single MAJOR severity issue with a clear, actionable rule (javabugs:S2259 — NullPointerException prevention). The fix is well-scoped and deterministic, replacing an unsafe null-comparison with a null-safe alternative that prevents runtime crashes.

Fixed a potential NullPointerException in InternalCheckVerifier that occurred when expectedMessage was null and .equals() was called directly on it. By using Objects.equals() instead, the code now safely handles null values without throwing an exception.

View Project in SonarCloud

---

Fixed Issues

javabugs:S2259 - Fix this access that will throw a NullPointerException when executed. • MAJOR • View issue

Location: java:java-checks-testkit/src/main/java/org/sonar/java/checks/verifier/internal/InternalCheckVerifier.java:407

Why is this an issue?

A reference to null should never be dereferenced/accessed. Doing so will cause a NullPointerException to be thrown. At best, such an exception will cause abrupt program termination. At worst, it could expose debugging information that would be useful to an attacker, or it could allow an attacker to bypass security measures.

What changed

This hunk fixes a potential NullPointerException that occurs when expectedMessage is null and .equals() is called on it. The variable expectedMessage is assigned from expectations.expectedFileIssue(), which can return null. The original code expectedMessage.equals(issue.getMessage()) would throw a NullPointerException when expectedMessage is null. By replacing it with Objects.equals(expectedMessage, issue.getMessage()), the code safely handles null values for either argument without throwing an exception.

--- a/java-checks-testkit/src/main/java/org/sonar/java/checks/verifier/internal/InternalCheckVerifier.java
+++ b/java-checks-testkit/src/main/java/org/sonar/java/checks/verifier/internal/InternalCheckVerifier.java
@@ -407,1 +407,1 @@ public class InternalCheckVerifier implements CheckVerifier {
-    if (!expectedMessage.equals(issue.getMessage())) {
+    if (!Objects.equals(expectedMessage, issue.getMessage())) {

Have a suggestion or found an issue? Share your feedback here.

---

SonarQube Remediation Agent uses AI. Check for mistakes.