cybercore-signer/config/spotbugs/exclude.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
    Exclusões do SpotBugs / FindSecBugs para o CyberCore Signer.
    Regra: toda exclusão deve ser específica (classe/padrão) e justificada em comentário.
-->
<FindBugsFilter
        xmlns="https://github.com/spotbugs/filter/3.0.0"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="https://github.com/spotbugs/filter/3.0.0 https://raw.githubusercontent.com/spotbugs/spotbugs/3.1.0/spotbugs/etc/findbugsfilter.xsd">

    <!--
        1. DTOs, Records e opções imutáveis que transferem dados estruturados (byte arrays, listas)
        onde cópias defensivas estritas causariam overhead desnecessário de alocação criptográfica.
    -->
    <Match>
        <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
        <Or>
            <Class name="br.com.cybercore.signer.core.diagnostics.DiagnosticReport"/>
            <Class name="br.com.cybercore.signer.core.domain.SigningResult"/>
            <Class name="br.com.cybercore.signer.core.domain.SigningKeyMaterial"/>
            <Class name="br.com.cybercore.signer.core.protocol.CcspRequest"/>
            <Class name="br.com.cybercore.signer.core.protocol.CcspResponse"/>
            <Class name="br.com.cybercore.signer.core.validation.ValidationResult"/>
            <Class name="br.com.cybercore.signer.core.validation.SignatureValidationService"/>
            <Class name="br.com.cybercore.signer.core.xml.XmlSignatureOptions"/>
            <Class name="br.com.cybercore.signer.core.pdf.PdfSignatureOptions"/>
            <Class name="br.com.cybercore.signer.core.pdf.PdfSignatureOptions$Builder"/>
            <Class name="br.com.cybercore.signer.core.pdf.seal.PdfSealData"/>
            <Class name="br.com.cybercore.signer.core.provider.Pkcs12CertificateProvider"/>
            <Class name="br.com.cybercore.signer.core.provider.Pkcs11CertificateProvider"/>
            <Package name="~br\.com\.cybercore\.signer\.ui\.view.*"/>
        </Or>
    </Match>

    <!--
        2. Singletons locais e serviços de sessão que utilizam métodos sincronizados para controle
        de concorrência thread-safe em memória local do agente desktop.
    -->
    <Match>
        <Bug pattern="USO_UNSAFE_METHOD_SYNCHRONIZATION,USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION"/>
        <Or>
            <Class name="br.com.cybercore.signer.core.security.SecurePinStorage"/>
            <Class name="br.com.cybercore.signer.core.security.PinSessionManager"/>
            <Class name="br.com.cybercore.signer.core.security.ApplicationRegistry"/>
            <Class name="br.com.cybercore.signer.core.config.AgentConfigurationService"/>
            <Class name="br.com.cybercore.signer.core.log.AppLogBuffer"/>
            <Class name="br.com.cybercore.signer.core.pdf.seal.CustomSealStorage"/>
            <Class name="br.com.cybercore.signer.core.provider.CertificateManager"/>
        </Or>
    </Match>

    <!--
        3. Construtores de Singletons com visibilidade default/package-private para permitir
        instanciação isolada durante testes unitários.
    -->
    <Match>
        <Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR"/>
        <Or>
            <Class name="br.com.cybercore.signer.core.security.ApplicationRegistry"/>
            <Class name="br.com.cybercore.signer.core.security.PinSessionManager"/>
            <Class name="br.com.cybercore.signer.core.security.SecurePinStorage"/>
            <Class name="br.com.cybercore.signer.core.config.AgentConfigurationService"/>
            <Class name="br.com.cybercore.signer.core.log.AppLogBuffer"/>
            <Class name="br.com.cybercore.signer.core.pdf.seal.CustomSealStorage"/>
        </Or>
    </Match>

    <!--
        4. Exceções lançadas em construtores de serviços criptográficos e diálogos que necessitam
        validar algoritmos ou dependências durante a instanciação (fail-fast).
    -->
    <Match>
        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
        <Or>
            <Class name="br.com.cybercore.signer.core.xml.XmlSigningService"/>
            <Class name="br.com.cybercore.signer.core.pdf.PdfSigningService"/>
            <Class name="br.com.cybercore.signer.core.pdf.PdfSigningService$PadesBouncyCastleSigner"/>
            <Class name="br.com.cybercore.signer.core.crypto.SigningService"/>
            <Class name="br.com.cybercore.signer.core.protocol.CcspServer"/>
            <Class name="br.com.cybercore.signer.core.provider.Pkcs12CertificateProvider"/>
            <Class name="br.com.cybercore.signer.core.crypto.tsa.TsaClient"/>
            <Class name="br.com.cybercore.signer.ui.tray.SystemTrayManager"/>
            <Package name="~br\.com\.cybercore\.signer\.ui\.view.*"/>
        </Or>
    </Match>

    <!--
        5. Tratamento de exceções amplo (catch Exception) intencional em rotinas defensivas de
        validação criptográfica e telemetria para não abortar o processo desktop.
    -->
    <Match>
        <Bug pattern="REC_CATCH_EXCEPTION"/>
        <Or>
            <Class name="br.com.cybercore.signer.core.validation.SignatureValidationService"/>
            <Class name="br.com.cybercore.signer.core.security.SecurePinStorage"/>
            <Class name="br.com.cybercore.signer.core.protocol.CcspServer"/>
            <Class name="br.com.cybercore.signer.core.protocol.CcspServer$SignXmlHandler"/>
            <Class name="br.com.cybercore.signer.ui.assets.AssetManager"/>
            <Package name="~br\.com\.cybercore\.signer\.ui\.view.*"/>
        </Or>
    </Match>

    <!--
        6. Instanciação única de SecureRandom em métodos locais para geração de nonces efêmeros.
    -->
    <Match>
        <Bug pattern="DMI_RANDOM_USED_ONLY_ONCE"/>
        <Class name="br.com.cybercore.signer.core.security.SecurePinStorage"/>
    </Match>

    <!--
        7. Validação de saída de diretório (mkdirs) e condições de contorno defensivas em parsing.
    -->
    <Match>
        <Bug pattern="RV_RETURN_VALUE_IGNORED_BAD_PRACTICE,UC_USELESS_CONDITION,NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
        <Or>
            <Class name="br.com.cybercore.signer.core.xml.XmlSigningService"/>
            <Class name="br.com.cybercore.signer.core.pdf.PdfSigningService"/>
            <Class name="br.com.cybercore.signer.core.validation.SignatureValidationService"/>
            <Class name="br.com.cybercore.signer.core.config.AgentConfigurationService"/>
            <Class name="br.com.cybercore.signer.core.protocol.CcspServer"/>
            <Class name="br.com.cybercore.signer.core.pdf.seal.CustomSealStorage"/>
            <Package name="~br\.com\.cybercore\.signer\.ui\.view.*"/>
        </Or>
    </Match>

    <!--
        8. Transformações locais de XML (FindSecBugs) utilizadas estritamente para montagem de
        assinaturas digitais XAdES locais sem ingestão de fontes remotas não confiáveis.
    -->
    <Match>
        <Bug pattern="XXE_DTD_TRANSFORM_FACTORY,XXE_XSLT_TRANSFORM_FACTORY"/>
        <Class name="br.com.cybercore.signer.core.xml.XmlSigningService"/>
    </Match>

    <!--
        9. Campos estáticos públicos e gerenciamento de ciclo de vida da interface gráfica JavaFX,
        servidor HTTP de loopback e do System Tray (incluindo saída voluntária System.exit).
    -->
    <Match>
        <Bug pattern="MS_EXPOSE_REP,ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD,DM_EXIT,DE_MIGHT_IGNORE,IS2_INCONSISTENT_SYNC,RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE,VA_FORMAT_STRING_USES_NEWLINE"/>
        <Or>
            <Class name="br.com.cybercore.signer.core.provider.WindowsCertificateStoreProvider"/>
            <Class name="br.com.cybercore.signer.core.security.ApplicationRegistry"/>
            <Class name="br.com.cybercore.signer.core.security.PinSessionManager"/>
            <Class name="br.com.cybercore.signer.core.security.SecurePinStorage"/>
            <Class name="br.com.cybercore.signer.core.pdf.seal.PdfSealThemeRegistry"/>
            <Class name="br.com.cybercore.signer.core.pdf.seal.CustomSealStorage"/>
            <Class name="br.com.cybercore.signer.core.protocol.CcspServer"/>
            <Class name="br.com.cybercore.signer.ui.CyberCoreDesktopApplication"/>
            <Class name="br.com.cybercore.signer.ui.tray.SystemTrayManager"/>
            <Class name="br.com.cybercore.signer.ui.assets.AssetManager"/>
            <Package name="~br\.com\.cybercore\.signer\.ui\.view.*"/>
        </Or>
    </Match>

    <!--
        10. Flags booleanas primitivas de linha de comando inicializadas no bootstrap da aplicação.
    -->
    <Match>
        <Bug pattern="AT_STALE_THREAD_WRITE_OF_PRIMITIVE"/>
        <Class name="br.com.cybercore.signer.app.CyberCoreSignerApplication"/>
    </Match>

    <!--
        11. Carregamento de driver PKCS#11 (middleware de fabricante de hardware criptográfico)
        apontando para bibliotecas dinâmicas do sistema operacional (.dll no Windows ou .so no Linux).
    -->
    <Match>
        <Bug pattern="PATH_TRAVERSAL_IN"/>
        <Class name="br.com.cybercore.signer.core.provider.Pkcs11CertificateProvider"/>
    </Match>

</FindBugsFilter>