How to avoid false positive "Null Dereference" error in Fortify

Question

I'm using "HP Fortify v3.50" on a java project and I find lots of false positive on "Null Dereference", because Fortify doesn't see the control against null is in another method. How can I reduce false positives and maintain the rule?

Here is a POC

public class MyClass {
    public static void main(String[] args) {
        String string01 = null;
        String string02 = null;     
        int i;

        if (args[0].equals("A")) {
            string01 = "X";
            string02 = "Y";
        }

        if (!isNull(string02)){
            i = string02.length();} //False Positive
        else {
            i = string02.length();
        } // Yes, it is an error!
    }

    public static boolean isNull(Object toBeTested){
        return (null == toBeTested);        
    }
}

Result:

[E8837DB548E01DB5794FA71F3D5F51C8 : medium : Null Dereference : controlflow ]
    MyClass.java(13) : Assigned null : string02
    MyClass.java(16) : Branch not taken: (!args[0].equals("A"))
    MyClass.java(20) : Branch taken: (!isNull(string02))           //False Positive
    MyClass.java(21) : Dereferenced : string02

[E8837DB548E01DB5794FA71F3D5F51C9 : medium : Null Dereference : controlflow ]
    MyClass.java(13) : Assigned null : string02
    MyClass.java(16) : Branch not taken: (!args[0].equals("A"))
    MyClass.java(20) : Branch not taken: isNull(string02)
    MyClass.java(23) : Dereferenced : string02

Answer 1

This looks more like an SCA issue that you should take to their support team. Alternatively just audit it as not an issue. This isn't something that can be fixed with a custom rule.