spotbugs-exclude.xml

<?xml version="1.0" encoding="UTF-8"?>
<FindBugsFilter
        xmlns="https://github.com/spotbugs/filter/3.0.0"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="https://github.com/spotbugs/filter/3.0.0 https://raw.githubusercontent.com/spotbugs/spotbugs/4.2.2/spotbugs/etc/findbugsfilter.xsd">
    <!--
        see https://spotbugs.readthedocs.io/en/latest/filter.html for documentation
    -->
    <Match>
        <Or>
            <!-- disable some known risks or minor warnings in test classes -->
            <Class name="~.*Test"/>
            <Class name="org.tbk.ngtor.NgtorApplicationConfig"/>
            <And>
                <Package name="org.tbk.ngtor.command"/>
                <Class name="~.*Command"/>
            </And>
        </Or>
        <!-- disable minor 'include CRLF characters into log messages' warning in test classes -->
        <Bug pattern="CRLF_INJECTION_LOGS"/>
    </Match>

    <Match>
        <Or>
            <!-- all classes named '*Api' or '*Ctrl' are known to be Spring endpoints and should not be reported -->
            <Class name="~.*Api"/>
            <Class name="~.*Ctrl"/>
        </Or>
        <Bug pattern="SPRING_ENDPOINT"/>
    </Match>

    <Match>
        <!-- it's okay to store Tor objects as field -->
        <Field name="tor" type="org.berndpruenster.netlayer.tor.Tor" />
        <Bug pattern="EI_EXPOSE_REP2"/>
    </Match>

    <Match>
        <Package name="~org.tbk.ngtor..*"/>
        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
    </Match>

</FindBugsFilter>