Suppress spotbugs false positive

microsoft · Jul 11, 2023 · 79cdc18 · 79cdc18
1 parent a33abc5
commit 79cdc18
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/.../src/main/java/com/microsoft/applicationinsights/agent/internal/init/FirstEntryPoint.java b/.../src/main/java/com/microsoft/applicationinsights/agent/internal/init/FirstEntryPoint.java
@@ -19,6 +19,7 @@
 import com.microsoft.applicationinsights.agent.internal.diagnostics.PidFinder;
 import com.microsoft.applicationinsights.agent.internal.diagnostics.SdkVersionFinder;
 import com.microsoft.applicationinsights.agent.internal.diagnostics.status.StatusFile;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import io.opentelemetry.javaagent.bootstrap.InstrumentationHolder;
 import io.opentelemetry.javaagent.bootstrap.InternalLogger;
 import io.opentelemetry.javaagent.bootstrap.JavaagentFileHolder;
@@ -160,6 +161,10 @@ private static String findSystemProperties() {
   }
 
   @Override
+  @SuppressFBWarnings(
+      value = "SECCRLFLOG", // CRLF injection into log messages
+      justification = "Logging params cannot be controlled by an end user of the instrumented application"
+  )
   public void onStartupSuccess() {
     startupLogger.info(
         "Application Insights Java Agent {} started successfully (PID {}, JVM running for {} s)",
@@ -282,6 +287,10 @@ private static void logErrorMessage(
     }
   }
 
+  @SuppressFBWarnings(
+      value = "SECCRLFLOG", // CRLF injection into log messages
+      justification = "Startup failure message cannot be controlled by an end user of the instrumented application"
+  )
   private static void logStartupFailure(boolean isFriendlyException, String message, Throwable t) {
     try (MDC.MDCCloseable ignored = STARTUP_FAILURE_ERROR.makeActive()) {
       if (isFriendlyException) {