spotbugs-filter.xml

<FindBugsFilter>

    <!-- STYLE warnings are not relevant for a library -->
    <Match>
        <Bug category="STYLE"/>
    </Match>

    <!-- Catching broad Exception is intentional — the encoder must never crash the JVM.
         A failed log event falls back to a minimal error JSON rather than propagating. -->
    <Match>
        <Bug pattern="REC_CATCH_EXCEPTION"/>
        <Class name="com.viz.logger.encoder.JsonLogEncoder"/>
    </Match>

    <!-- Same rationale: masking must never crash the logger — returns original value on error. -->
    <Match>
        <Bug pattern="REC_CATCH_EXCEPTION"/>
        <Class name="com.viz.logger.masking.MaskingRule"/>
    </Match>

    <!-- Hostname resolution at startup silently falls back to "unknown-host".
         Logging the exception here would create a circular dependency. -->
    <Match>
        <Bug pattern="REC_CATCH_EXCEPTION"/>
        <Class name="com.viz.logger.enricher.StaticFieldsEnricher"/>
    </Match>
    <Match>
        <Bug pattern="DE_MIGHT_IGNORE"/>
        <Class name="com.viz.logger.enricher.StaticFieldsEnricher"/>
    </Match>

    <!-- ExceptionEnricher intentionally serialises full stack traces — that is its purpose.
         Suppressing stack traces would defeat the point of structured error logging. -->
    <Match>
        <Bug pattern="INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE"/>
        <Class name="com.viz.logger.enricher.ExceptionEnricher"/>
    </Match>

    <!-- MdcRequestFilter propagates X-Request-Id and X-Trace-Id from request to response
         as correlation headers. Values are trace IDs (UUID / short hex), not user input.
         Modern servlet containers strip CRLF from header values automatically. -->
    <Match>
        <Bug pattern="HTTP_RESPONSE_SPLITTING"/>
        <Class name="com.viz.logger.context.MdcRequestFilter"/>
    </Match>
    <Match>
        <Bug pattern="HEADER_INJECTION"/>
        <Class name="com.viz.logger.context.MdcRequestFilter"/>
    </Match>

    <!-- doFilter() casts ServletRequest/Response to Http* only after routing through
         the Servlet container, which guarantees Http types for HTTP dispatchers. -->
    <Match>
        <Bug pattern="BC_UNCONFIRMED_CAST"/>
        <Class name="com.viz.logger.context.MdcRequestFilter"/>
    </Match>

    <!-- MDC values written from HTTP headers are JSON-serialised by Jackson,
         which escapes control characters — CRLF injection into log output is not possible. -->
    <Match>
        <Bug pattern="CRLF_INJECTION_LOGS"/>
        <Or>
            <Class name="com.viz.logger.context.MdcRequestFilter"/>
            <Class name="com.viz.logger.context.LogContextBuilder"/>
        </Or>
    </Match>

</FindBugsFilter>