False positives found when libs use reflection

[carstenhag]

Describe the bug
Some false positives (afaik) are found on our project. Example below.

To Reproduce
Steps to reproduce the behavior:

1. Add deps
2. Scan
3. See false positive :D

Expected behavior
In the below cases there shouldn't be a warning as far as I understand.

Screenshots

Scanning com.microsoft.appcenter:espresso-test-extension:1.4
/Users/carstenh/.gradle/caches/modules-2/files-2.1/com.microsoft.appcenter/espresso-test-extension/1.4/d95d919a5195d439334f79834fc5c6bc1dada78a/espresso-test-extension-1.4.aar
 * com/microsoft/appcenter/espresso/Factory.class -> android.support.test.InstrumentationRegistry

--> https://github.com/microsoft/AppCenter-Test-Espresso-Extensions/blob/master/src/main/java/com/microsoft/appcenter/espresso/Factory.java

Scanning com.mixpanel.android:mixpanel-android:5.8.5
/Users/carstenh/.gradle/caches/modules-2/files-2.1/com.mixpanel.android/mixpanel-android/5.8.5/11cd1c3ab4c5c23ab080edcf015e8baaeb5d773a/mixpanel-android-5.8.5.aar
 * com/mixpanel/android/mpmetrics/MixpanelAPI.class -> android.support.v4.content.LocalBroadcastManager

--> https://github.com/mixpanel/mixpanel-android/blob/master/src/main/java/com/mixpanel/android/mpmetrics/MixpanelAPI.java

[carstenhag]

Robolectric 4.4 shadows multidex also has a warning, but I think it's using androidX.

Scanning org.robolectric:shadows-multidex:4.4
/Users/carstenh/.gradle/caches/modules-2/files-2.1/org.robolectric/shadows-multidex/4.4/33fbcaaf91449ec1aa74078024f07b219723fa/shadows-multidex-4.4.jar
 * org/robolectric/shadows/multidex/Shadows.class -> android/support/multidex/MultiDex
 * org/robolectric/shadows/multidex/Shadows.class -> android.support.multidex.MultiDex
 * org/robolectric/shadows/multidex/ShadowMultiDex.class -> android/support/multidex/MultiDex

--> https://github.com/robolectric/robolectric/tree/master/shadows/multidex/src/main/java/org/robolectric/shadows/multidex

[maxirosson]

org.robolectric:shadows-multidex:4.4 is not migrated to androidx. It is using android.support.multidex.MultiDex, so no false positive here

Robolectric 4.4 shadows multidex also has a warning, but I think it's using androidX.

Scanning org.robolectric:shadows-multidex:4.4
/Users/carstenh/.gradle/caches/modules-2/files-2.1/org.robolectric/shadows-multidex/4.4/33fbcaaf91449ec1aa74078024f07b219723fa/shadows-multidex-4.4.jar
 * org/robolectric/shadows/multidex/Shadows.class -> android/support/multidex/MultiDex
 * org/robolectric/shadows/multidex/Shadows.class -> android.support.multidex.MultiDex
 * org/robolectric/shadows/multidex/ShadowMultiDex.class -> android/support/multidex/MultiDex

--> https://github.com/robolectric/robolectric/tree/master/shadows/multidex/src/main/java/org/robolectric/shadows/multidex

[maxirosson]

com.mixpanel.android:mixpanel-android:5.8.5 is also using android support lib.

   private static void registerAppLinksListeners(Context context, final MixpanelAPI mixpanel) {
        // Register a BroadcastReceiver to receive com.parse.bolts.measurement_event and track a call to mixpanel
        try {
            final Class<?> clazz = Class.forName("android.support.v4.content.LocalBroadcastManager");
            final Method methodGetInstance = clazz.getMethod("getInstance", Context.class);
            final Method methodRegisterReceiver = clazz.getMethod("registerReceiver", BroadcastReceiver.class, IntentFilter.class);
            final Object localBroadcastManager = methodGetInstance.invoke(null, context);
            methodRegisterReceiver.invoke(localBroadcastManager, new BroadcastReceiver() {
                @Override
                public void onReceive(Context context, Intent intent) {
                    final JSONObject properties = new JSONObject();
                    final Bundle args = intent.getBundleExtra("event_args");
                    if (args != null) {
                        for (final String key : args.keySet()) {
                            try {
                                properties.put(key, args.get(key));
                            } catch (final JSONException e) {
                                MPLog.e(APP_LINKS_LOGTAG, "failed to add key \"" + key + "\" to properties for tracking bolts event", e);
                            }
                        }
                    }
                    mixpanel.track("$" + intent.getStringExtra("event_name"), properties);
                }
            }, new IntentFilter("com.parse.bolts.measurement_event"));
        } catch (final InvocationTargetException e) {
            MPLog.d(APP_LINKS_LOGTAG, "Failed to invoke LocalBroadcastManager.registerReceiver() -- App Links tracking will not be enabled due to this exception", e);
        } catch (final ClassNotFoundException e) {
            MPLog.d(APP_LINKS_LOGTAG, "To enable App Links tracking android.support.v4 must be installed: " + e.getMessage());
        } catch (final NoSuchMethodException e) {
            MPLog.d(APP_LINKS_LOGTAG, "To enable App Links tracking android.support.v4 must be installed: " + e.getMessage());
        } catch (final IllegalAccessException e) {
            MPLog.d(APP_LINKS_LOGTAG, "App Links tracking will not be enabled due to this exception: " + e.getMessage());
        }
    }

[carstenhag]

About Mixpanel: I saw that, but I thought as it's not imported its not a "real" use of it. Am I wrong there? Should they use reflection on an androidx class?

[maxirosson]

About Mixpanel: I saw that, but I thought as it's not imported its not a "real" use of it. Am I wrong there? Should they use reflection on an androidx class?

Invoking by reflection is also a real use of the support. I particularly don't know that lib, but if you think that the registerAppLinksListeners is not going to be invoked but your app or it's not important for you, you can decide yo just exclude that warning:

byeByeJetifier {
    excludedFilesFromScanning += ["com/mixpanel/android/mpmetrics/MixpanelAPI"]
}

[maxirosson]

Regarding com.microsoft.appcenter:espresso-test-extension:1.4

    private static String locations[] = {"androidx.test.platform.app.InstrumentationRegistry",
            "androidx.test.InstrumentationRegistry",
            "android.support.test.InstrumentationRegistry"};

in this case the reference the support, but also androidx, so its safe to exclude that file

byeByeJetifier {
    excludedFilesFromScanning += ["com/microsoft/appcenter/espresso/Factory.class"]
}

[maxirosson]

Given that there is nothing to do on the plugin side, I will close this issue.
I plan to write another post to teach a bit moe about how to handle these cases and configure the plugin using the byeByeJetifier extension

[carstenhag]

Agree, will create issues on the robolectric/Mixpanel repos so they can also analyze it.

Thanks for looking at it! :)

[maxirosson]

Hi. I find out that robolectric has ShadowAndroidXMultiDex & ShadowMultiDex classes. You can just use ShadowAndroidXMultiDex in your code and ignore org/robolectric/shadows/multidex/ShadowMultiDex on the plugin