Make "class" transient or serializable BUT the class is serializable

Question

SonarQube 5.1 marks a lot of critical issues after reviewing my code. However the class itself and the referenced class in the field is also serializable. The referenced class inherits the serializable interface through a class.

Here is my example

public class A implements Serializable {
     private B b;  // -> Sonarcube markes this field as not serialzable
}

And the class B is defined as follows

public class B extends C {
 ....
}

And the class C is defined as follows

public abstract class C extends D {
 ....
}

And the class D is defined

public abstract class D implements Serializable {
  ....
}

Running FindBugs on the same project does not see these problems. I am not sure if it is a bug in sonarcube or is my code has some other problems (other fields in the classes C,D or something else)

Does anybody has a clue ?

Answer 1

It is probably because the binary files are not provided correctly. I had a similar issue with my SonarQube configuration, then I discovered that the classes that implement Serializable are in different modules and/or in an external library.

Setting correct values for sonar.java.binaries and sonar.java.libraries allow SonarQube to locate the binaries and correctly determine whether or not the classes are serializable.