monits/findbugs-plugin

A FindBugs Plugin for Java & J2EE

findbugs-plugin's Issues

java.lang.NullPointerException al correr findbugs

Ejecuté ./gradlew build y al finalizar el análisis tiro:

The following errors occurred during analysis: Exception analyzing com.mercadolibre.android.checkout.common.components.shipping.contactinfo.add.presenter.NewContactAction using detector com.monits.findbugs.effectivejava.ToStringDetector java.lang.NullPointerException At com.monits.findbugs.effectivejava.ToStringDetector.isIgnored(ToStringDetector.java:173) At com.monits.findbugs.effectivejava.ToStringDetector.isClassFieldAnInterestingField(ToStringDetector.java:189) At com.monits.findbugs.effectivejava.ToStringDetector.getInterestingFields(ToStringDetector.java:154) At com.monits.findbugs.effectivejava.ToStringDetector.visitClassContext(ToStringDetector.java:102) At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76) At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089) At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283) At org.gradle.api.plugins.quality.internal.findbugs.FindBugsExecuter.runFindbugs(FindBugsExecuter.java:39) At sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) At sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) At sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) At java.lang.reflect.Method.invoke(Method.java:498) At org.gradle.process.internal.DefaultSingleUseWorkerProcessBuilder$WorkerAction.run(DefaultSingleUseWorkerProcessBuilder.java:197) At sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) At sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) At sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) At java.lang.reflect.Method.invoke(Method.java:498) At org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:35) At org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:24) At org.gradle.messaging.remote.internal.hub.MessageHub$Handler.run(MessageHub.java:364) At org.gradle.internal.concurrent.ExecutorPolicy$CatchAndRecordFailures.onExecute(ExecutorPolicy.java:54) At org.gradle.internal.concurrent.StoppableExecutorImpl$1.run(StoppableExecutorImpl.java:40) At java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) At java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) At java.lang.Thread.run(Thread.java:745) Exception analyzing com.mercadolibre.android.checkout.common.components.shipping.contactinfo.add.presenter.SaveContactAction using detector com.monits.findbugs.effectivejava.ToStringDetector java.lang.NullPointerException At com.monits.findbugs.effectivejava.ToStringDetector.isIgnored(ToStringDetector.java:173) At com.monits.findbugs.effectivejava.ToStringDetector.isClassFieldAnInterestingField(ToStringDetector.java:189) At com.monits.findbugs.effectivejava.ToStringDetector.getInterestingFields(ToStringDetector.java:154) At com.monits.findbugs.effectivejava.ToStringDetector.visitClassContext(ToStringDetector.java:102) At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76) At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089) At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283) At org.gradle.api.plugins.quality.internal.findbugs.FindBugsExecuter.runFindbugs(FindBugsExecuter.java:39) At sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) At sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) At sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) At java.lang.reflect.Method.invoke(Method.java:498) At org.gradle.process.internal.DefaultSingleUseWorkerProcessBuilder$WorkerAction.run(DefaultSingleUseWorkerProcessBuilder.java:197) At sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) At sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) At sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) At java.lang.reflect.Method.invoke(Method.java:498) At org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:35) At org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:24) At org.gradle.messaging.remote.internal.hub.MessageHub$Handler.run(MessageHub.java:364) At org.gradle.internal.concurrent.ExecutorPolicy$CatchAndRecordFailures.onExecute(ExecutorPolicy.java:54) At org.gradle.internal.concurrent.StoppableExecutorImpl$1.run(StoppableExecutorImpl.java:40) At java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) At java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) At java.lang.Thread.run(Thread.java:745)

sync with maven central

Thanks for the 0.2.0 release!

Would it be possible to sync with maven central ?

My company is in a regulated environment (pharmaceuticals), and moving from maven central to jcenter would be a big decision, because of the paperwork and validation involved in the process.

False positive concatenating strings

Findbugs reports FB.W.USELESS_STRING_VALUEOF_CALL on this snippet

public void sendMessage(final String msg, final User user) {
    LOGGER.info(msg + " -> " + user.getAccount());
}

False positive when a class have suppressed MISSING_TO_STRING_OVERRIDE

When a class have suppressed MISSING_TO_STRING_OVERRIDE and this class is used in another, FindBugs reports MISSING_FIELD_IN_TO_STRING.

Ex:

@SuppressFBWarnings(value = 'MISSING_TO_STRING_OVERRIDE',
        justification = 'We don\'t want to implement toString() to show the breed')
public class dog {
    private String breed;
}

public class MyDog {
    private Dog dog;
    private String name;

    @Override
    public String toString() {
        return 'MyDog{'
            + 'name=' + name
            + '}';
    }
}

When analyzing MyDog it says:
The field dog is not included in the current toString implementation. Having a meaningful and complete toString will help developers debug code, by providing more meaningful inspections out of the box. For more information, refer to Effective Java, item 10.

Using Older Version of Guava that is Vulnerable to CVE-2018-10237

We've been using this plugin for a while along with the latest version of spotbugs and really appreciate the issues that it points out. I noticed that the project is using a version of guava that is vulnerable to CVE-2018-10237.

I noticed that this project has been kept on Java 7 to match the pulled in the version of findbugs. It looks like there is not a version of guava that is built on Java 7 with this issue resolved. Since 24.1.1 is the last version of guava that is vulnerable to this issue and that is after the split to guava-jre and guava-android. What about using one of the guava-android dependencies since those are still on Java 7 to resolve the issue? Or the version of the findbugs library could be updated since the latest is now using Java 8 and then take the latest version of guava-jre. I'd be happy to contribute a pull request if there is interest.

Thanks again!

https://nvd.nist.gov/vuln/detail/CVE-2018-10237

False positive for NON_STATIC_PATTERN_COMPILE_CALL

I have something like:

public final class RegexHelpers {
	private RegexHelpers() {
	}

	public static Pattern getUnescapedSymbolPattern(char symbol) {
		return Pattern.compile(getUnescapedSymbolRegex(symbol));
	}

	public static String getUnescapedSymbolRegex(char symbol) {
		String escapedSymbol = Pattern.quote(String.valueOf(symbol));
		return "(^|[^\\\\])(\\\\\\\\)*" + escapedSymbol; // (^|[^\\])(\\\\)*,
	}
}

Which gives a NON_STATIC_PATTERN_COMPILE_CALL.

I also have another case of a false positive in code like:

	private boolean propertyMatchesText(String test, String text, boolean shouldMatchWholeString) {
		String pcre = SomeHelpers.textToPcre(text, shouldMatchWholeString);
		int caseInsensitiveFlag = isCaseInsensitive() ? Pattern.CASE_INSENSITIVE : 0;
		Pattern pattern = Pattern.compile(pcre, caseInsensitiveFlag | Pattern.UNICODE_CASE);
		return pattern.matcher(test).find();
	}

MISSING_TO_STRING_OVERRIDE with invalid field

The folllowing class is reported as MISSING_TO_STRING_OVERRIDE

public class FSTSerializationStrategy implements SerializationStrategy {
    private final FSTConfiguration config;
        ...

This shouldn't happen as:

1. FSTConfiguration doesn't override toString
2. FSTConfiguration is a library class, and therefore, we can't add the missing toString to it.

The current detector should ignore fields that are not part of the application being analyzed, and do not override toString.

Possibly, the first condition can be tested using AnalysisContext.isApplicationClass(), though I'm not sure.

VisitedFieldFinder should override toString

The class jp.co.worksap.oss.findbugs.jpa.VisitedFieldFinder has an internal state and should therefore override toString.

Having a meaningful and complete toString will help developers debug code, by providing more meaningful inspections out of the box. For more information, refer to Effective Java, item 10.

NPE in UnknownNullnessDetector

 [java]   Exception analyzing com.monits.carol.service.provider.OverEstimatedTaskMetricProviderImpl using detector jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector
 [java]     java.lang.NullPointerException
 [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.signaturesMatches(UnknownNullnessDetector.java:257)
 [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:225)
 [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:232)
 [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:150)
 [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.visit(UnknownNullnessDetector.java:71)
 [java]       At edu.umd.cs.findbugs.visitclass.BetterVisitor.visitMethod(BetterVisitor.java:351)
 [java]       At org.apache.bcel.classfile.Method.accept(Method.java:106)
 [java]       At edu.umd.cs.findbugs.visitclass.PreorderVisitor.doVisitMethod(PreorderVisitor.java:304)
 [java]       At edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitJavaClass(PreorderVisitor.java:395)
 [java]       At org.apache.bcel.classfile.JavaClass.accept(JavaClass.java:215)
 [java]       At edu.umd.cs.findbugs.BytecodeScanningDetector.visitClassContext(BytecodeScanningDetector.java:38)
 [java]       At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
 [java]       At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089)
 [java]       At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283)
 [java]       At edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:402)
 [java]       At edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1200)

FP on UNKNOWN_NULLNESS_OF_PARAMETER of inherited method

When implementing Wicket's IModel I get a UNKNOWN_NULLNESS_OF_PARAMETER on inherited method setObject(T) which is inherited.

My guess is that the generics are causing this.

repository is slow

First of all thanks for your effort !

I am experiencing very slow downloads from these repositories
http://nexus.monits.com/content/repositories/

2mb download in about 1 minute or more.

Is it possible to move this repository to another host or an OSS host ?

Thanks

NON_STATIC_PATTERN_COMPILE_CALL still thrown for static Derivatives of Predicate

Great addition. We just started using this in our project and the error descriptions thrown out for each bug is very informative and much appreciated.

I have a small issue to report:

private static final Predicate<String> predicateString = Pattern.compile("test").asPredicate() throws NON_STATIC_PATTERN_COMPILE_CALL even though logically the pattern is compiled once.

The workaround we used was to create a redundant static Pattern object and then use that to create another static predicate.

private static final Pattern patternString = Pattern.compile("test");
private static final Predicate<String> predicateString = patternString.asPredicate();

NPE in nullness detector

     [java]   Exception analyzing com.monits.cbm.model.document.DocumentType using detector jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector
     [java]     java.lang.NullPointerException
     [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.getBoundGenericsInClassSignature(UnknownNullnessDetector.java:188)
     [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:219)
     [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:230)
     [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:157)
     [java]       At jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.visit(UnknownNullnessDetector.java:75)
     [java]       At edu.umd.cs.findbugs.visitclass.BetterVisitor.visitMethod(BetterVisitor.java:351)
     [java]       At org.apache.bcel.classfile.Method.accept(Method.java:106)
     [java]       At edu.umd.cs.findbugs.visitclass.PreorderVisitor.doVisitMethod(PreorderVisitor.java:304)
     [java]       At edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitJavaClass(PreorderVisitor.java:395)
     [java]       At org.apache.bcel.classfile.JavaClass.accept(JavaClass.java:215)
     [java]       At edu.umd.cs.findbugs.BytecodeScanningDetector.visitClassContext(BytecodeScanningDetector.java:38)
     [java]       At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
     [java]       At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089)
     [java]       At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283)
     [java]       At edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:402)
     [java]       At edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1200)

Where DocumentType is

/*
 * Copyright (c) 2010-2014 Monits S.A. <http://www.monits.com/>
 */
package com.monits.cbm.model.document;

/**
 * Enum for Monits Document Types
 *
 * @author rpereyra
 */
public enum DocumentType {
    PROCESS, CULTURE, AVAILABLE_DEVICES,
    EQUIPEMENT_REQUEST, SUPPORT_REQUEST,
    DEVICE_REQUEST, MANAGEMENT_ORDERS;
}

IllegalArgumentException in UnknownNullnessDetector

<Exception>java.lang.IllegalArgumentException: Illegal group reference</Exception>
      <StackTrace>java.util.regex.Matcher.appendReplacement(Matcher.java:857)</StackTrace>
      <StackTrace>java.util.regex.Matcher.replaceAll(Matcher.java:955)</StackTrace>
      <StackTrace>java.lang.String.replaceAll(String.java:2210)</StackTrace>
      <StackTrace>jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.signaturesMatches(UnknownNullnessDetector.java:267)</StackTrace>
      <StackTrace>jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:238)</StackTrace>
      <StackTrace>jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:247)</StackTrace>
      <StackTrace>jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:247)</StackTrace>
      <StackTrace>jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:150)</StackTrace>
      <StackTrace>jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.visit(UnknownNullnessDetector.java:71)</StackTrace>
      <StackTrace>edu.umd.cs.findbugs.visitclass.BetterVisitor.visitMethod(BetterVisitor.java:351)</StackTrace>
      <StackTrace>org.apache.bcel.classfile.Method.accept(Method.java:106)</StackTrace>
      <StackTrace>edu.umd.cs.findbugs.visitclass.PreorderVisitor.doVisitMethod(PreorderVisitor.java:304)</StackTrace>
      <StackTrace>edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitJavaClass(PreorderVisitor.java:395)</StackTrace>
      <StackTrace>org.apache.bcel.classfile.JavaClass.accept(JavaClass.java:215)</StackTrace>
      <StackTrace>edu.umd.cs.findbugs.BytecodeScanningDetector.visitClassContext(BytecodeScanningDetector.java:38)</StackTrace>
      <StackTrace>edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)</StackTrace>
      <StackTrace>edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089)</StackTrace>
      <StackTrace>edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283)</StackTrace>
      <StackTrace>org.gradle.api.plugins.quality.internal.findbugs.FindBugsExecuter.runFindbugs(FindBugsExecuter.java:44)</StackTrace>
      <StackTrace>org.gradle.api.plugins.quality.internal.findbugs.FindBugsWorkerServer.execute(FindBugsWorkerServer.java:44)</StackTrace>
      <StackTrace>org.gradle.api.plugins.quality.internal.findbugs.FindBugsWorkerServer.execute(FindBugsWorkerServer.java:35)</StackTrace>
      <StackTrace>org.gradle.api.plugins.quality.internal.findbugs.FindBugsWorkerServer.execute(FindBugsWorkerServer.java:26)</StackTrace>
      <StackTrace>org.gradle.process.internal.child.ActionExecutionWorker.execute(ActionExecutionWorker.java:85)</StackTrace>
      <StackTrace>org.gradle.process.internal.child.ActionExecutionWorker.execute(ActionExecutionWorker.java:37)</StackTrace>
      <StackTrace>org.gradle.process.internal.child.ImplementationClassLoaderWorker.execute(ImplementationClassLoaderWorker.java:87)</StackTrace>
      <StackTrace>org.gradle.process.internal.child.ImplementationClassLoaderWorker.execute(ImplementationClassLoaderWorker.java:41)</StackTrace>
      <StackTrace>org.gradle.process.internal.child.IsolatedApplicationClassLoaderWorker.call(IsolatedApplicationClassLoaderWorker.java:48)</StackTrace>
      <StackTrace>org.gradle.process.internal.launcher.IsolatedGradleWorkerMain.run(IsolatedGradleWorkerMain.java:47)</StackTrace>
      <StackTrace>org.gradle.process.internal.launcher.IsolatedGradleWorkerMain.main(IsolatedGradleWorkerMain.java:52)</StackTrace>

False positive caling a method @VisibleForTesting from @Before or other method

When calling a method of a class that has been annotated with guava's @VisibleForTesting, the plugin reports a warning (FB.W.GUAVA_UNEXPECTED_ACCESS_TO_VISIBLE_FOR_TESTING) if the method is being call from outside a test method.

This casues problems when:

1. We call the method as part of building the text fixture from a @before method
2. We call the method as part of a helper method building test objects, called from either a setup method or an actual test method

FP on NON_STATIC_PATTERN_COMPILE_CALL

This snippet is falsely reported as a non static pattern compile (can't be static, since it depends on method's input).

private Pattern getSuffixPattern(final String email) {
        final String[] parts = email.split("@");
        Assert.isTrue(parts.length == 2, "The email used by SessionFactoryService has more than one '@'");

        return Pattern.compile("^" + parts[0] + "\\+([^@]+)@" + parts[1] + "$");
    }

Null annotation detection doesn't propagate class or package level annotations to private methods

Let's say you define a new nul annotation:

@Nonnull
@Target({ElementType.PACKAGE, ElementType.TYPE, ElementType.METHOD})
@TypeQualifierDefault({ElementType.METHOD, ElementType.PARAMETER})
@Retention(RetentionPolicy.RUNTIME)
public @interface DefaultNonNull {}

If you apply that annotation at package level or class level, it will work fine except for private methods.

Private methods will raise a warning stating that nullness of their parameter and return values is unknown. If you add the annotation directly on the method, the warning goes away, but that defeats the purpose of setting a package or class level default.

This only affects private methods. Public, package and protected methods work fine.

False positive for HASHCHODE_HAS_MORE_FIELDS_THAN_EQUALS

Something like:

import java.util.Objects;

import com.google.common.collect.ComparisonChain;

public class Version implements Comparable<Version> {
	private final int major;
	private final int minor;
	private final int build;

	public Version(int major, int minor, int build) {
		this.major = major;
		this.minor = minor;
		this.build = build;
	}

	@Override
	public boolean equals(Object object) {
		return object instanceof Version && compareTo((Version) object) == 0;
	}

	@Override
	public int hashCode() {
		return Objects.hash(major, minor, build);
	}

	@Override
	public int compareTo(Version other) {
		return ComparisonChain.start()
			.compare(major, other.major)
			.compare(minor, other.minor)
			.compare(build, other.build)
			.result();
	}
}

Gives a HASHCHODE_HAS_MORE_FIELDS_THAN_EQUALS warning which is not correct.

Crash analyzing a wicket WebPage

I get the following stacktrace:

Exception analyzing com.monits.cbm.web.controller.user.downloads.DocumentsUpload using detector jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector
java.lang.StringIndexOutOfBoundsException: String index out of range: -1
java.lang.String.substring(String.java:1955)
jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.getBoundGenericsInClassSignature(UnknownNullnessDetector.java:200)
jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:221)
jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:232)
jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:232)
jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:232)
jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:232)
jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.findSuperMethods(UnknownNullnessDetector.java:157)
jp.co.worksap.oss.findbugs.jsr305.nullness.UnknownNullnessDetector.visit(UnknownNullnessDetector.java:75)
edu.umd.cs.findbugs.visitclass.BetterVisitor.visitMethod(BetterVisitor.java:351)
org.apache.bcel.classfile.Method.accept(Method.java:106)
edu.umd.cs.findbugs.visitclass.PreorderVisitor.doVisitMethod(PreorderVisitor.java:304)
edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitJavaClass(PreorderVisitor.java:395)
org.apache.bcel.classfile.JavaClass.accept(JavaClass.java:215)
edu.umd.cs.findbugs.BytecodeScanningDetector.visitClassContext(BytecodeScanningDetector.java:38)
edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089)
edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283)
edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:402)
edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1200)

NullPointerException in PluginLoader

Hi, I'm using Gradle 3.5 and FindBugs 3.0.1 with a couple of other plugins. This is my configuration:

findbugs 'com.google.code.findbugs:findbugs:3.0.1'
findbugs configurations.findbugsPlugins.dependencies
findbugsPlugins 'com.h3xstream.findsecbugs:findsecbugs-plugin:1.6.0'
findbugsPlugins 'com.mebigfatguy.fb-contrib:fb-contrib:7.0.2'
findbugsPlugins 'com.monits:findbugs-plugin:0.2.0'

Without the last line, everything works as expected. When I include it, I get:

Caused by: java.lang.NullPointerException
        at edu.umd.cs.findbugs.PluginLoader.getPluginDescriptor(PluginLoader.java:1168)
        at edu.umd.cs.findbugs.PluginLoader.init(PluginLoader.java:653)
        at edu.umd.cs.findbugs.PluginLoader.<init>(PluginLoader.java:211)
        at edu.umd.cs.findbugs.PluginLoader.getPluginLoader(PluginLoader.java:1359)
        at edu.umd.cs.findbugs.Plugin.addCustomPlugin(Plugin.java:684)
        at edu.umd.cs.findbugs.Plugin.addCustomPlugin(Plugin.java:676)
        at edu.umd.cs.findbugs.Plugin.loadCustomPlugin(Plugin.java:668)
        at edu.umd.cs.findbugs.Plugin.loadCustomPlugin(Plugin.java:661)
        at edu.umd.cs.findbugs.FindBugsCommandLine.handleOptionWithArgument(FindBugsCommandLine.java:148)
        at edu.umd.cs.findbugs.TextUICommandLine.handleOptionWithArgument(TextUICommandLine.java:573)
        at edu.umd.cs.findbugs.config.CommandLine.parse(CommandLine.java:340)
        at edu.umd.cs.findbugs.config.CommandLine.parse(CommandLine.java:307)
        at edu.umd.cs.findbugs.FindBugs.processCommandLine(FindBugs.java:347)
        at org.gradle.api.plugins.quality.internal.findbugs.FindBugsExecuter.runFindbugs(FindBugsExecuter.java:38)

Am I doing something wrong?