[nullsafe] Add checks to warn about misuse of nested class @Nullsafe annotations

Summary:
In the previous diff we changed the semantics of nested classes w.r.t.
to Nullsafe.
Let's make it clear if users will attempt to misuse it.

Reviewed By: artempyanykh

Differential Revision: D21230717

fbshipit-source-id: 0ecc0dd06

infer/man/man1/infer-full.txt

@@ -398,6 +398,7 @@ OPTIONS
              DIVIDE_BY_ZERO (disabled by default),
              DO_NOT_REPORT (enabled by default),
              EMPTY_VECTOR_ACCESS (enabled by default),
+             ERADICATE_BAD_NESTED_CLASS_ANNOTATION (enabled by default),
              ERADICATE_CONDITION_REDUNDANT (enabled by default),
              ERADICATE_CONDITION_REDUNDANT_NONNULL (enabled by default),
              ERADICATE_FIELD_NOT_INITIALIZED (enabled by default),
@@ -412,6 +413,8 @@ OPTIONS
              ERADICATE_META_CLASS_NEEDS_IMPROVEMENT (disabled by default),
              ERADICATE_NULLABLE_DEREFERENCE (enabled by default),
              ERADICATE_PARAMETER_NOT_NULLABLE (enabled by default),
+             ERADICATE_REDUNDANT_NESTED_CLASS_ANNOTATION (enabled by
+           default),
              ERADICATE_RETURN_NOT_NULLABLE (enabled by default),
              ERADICATE_RETURN_OVER_ANNOTATED (enabled by default),
              ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE (enabled by default),

infer/man/man1/infer-report.txt

@@ -128,6 +128,7 @@ OPTIONS
              DIVIDE_BY_ZERO (disabled by default),
              DO_NOT_REPORT (enabled by default),
              EMPTY_VECTOR_ACCESS (enabled by default),
+             ERADICATE_BAD_NESTED_CLASS_ANNOTATION (enabled by default),
              ERADICATE_CONDITION_REDUNDANT (enabled by default),
              ERADICATE_CONDITION_REDUNDANT_NONNULL (enabled by default),
              ERADICATE_FIELD_NOT_INITIALIZED (enabled by default),
@@ -142,6 +143,8 @@ OPTIONS
              ERADICATE_META_CLASS_NEEDS_IMPROVEMENT (disabled by default),
              ERADICATE_NULLABLE_DEREFERENCE (enabled by default),
              ERADICATE_PARAMETER_NOT_NULLABLE (enabled by default),
+             ERADICATE_REDUNDANT_NESTED_CLASS_ANNOTATION (enabled by
+           default),
              ERADICATE_RETURN_NOT_NULLABLE (enabled by default),
              ERADICATE_RETURN_OVER_ANNOTATED (enabled by default),
              ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE (enabled by default),

infer/man/man1/infer.txt

@@ -398,6 +398,7 @@ OPTIONS
              DIVIDE_BY_ZERO (disabled by default),
              DO_NOT_REPORT (enabled by default),
              EMPTY_VECTOR_ACCESS (enabled by default),
+             ERADICATE_BAD_NESTED_CLASS_ANNOTATION (enabled by default),
              ERADICATE_CONDITION_REDUNDANT (enabled by default),
              ERADICATE_CONDITION_REDUNDANT_NONNULL (enabled by default),
              ERADICATE_FIELD_NOT_INITIALIZED (enabled by default),
@@ -412,6 +413,8 @@ OPTIONS
              ERADICATE_META_CLASS_NEEDS_IMPROVEMENT (disabled by default),
              ERADICATE_NULLABLE_DEREFERENCE (enabled by default),
              ERADICATE_PARAMETER_NOT_NULLABLE (enabled by default),
+             ERADICATE_REDUNDANT_NESTED_CLASS_ANNOTATION (enabled by
+           default),
              ERADICATE_RETURN_NOT_NULLABLE (enabled by default),
              ERADICATE_RETURN_OVER_ANNOTATED (enabled by default),
              ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE (enabled by default),

infer/src/base/IssueType.ml

@@ -261,6 +261,16 @@ let eradicate_inconsistent_subclass_return_annotation =
     ~hum:"Inconsistent Subclass Return Annotation"
 
 
+let eradicate_redundant_nested_class_annotation =
+  register_from_string "ERADICATE_REDUNDANT_NESTED_CLASS_ANNOTATION"
+    ~hum:"@Nullsafe annotation is redundant"
+
+
+let eradicate_bad_nested_class_annotation =
+  register_from_string "ERADICATE_BAD_NESTED_CLASS_ANNOTATION"
+    ~hum:"@Nullsafe annotation is inconsistent with outer class"
+
+
 let eradicate_nullable_dereference =
   register_from_string "ERADICATE_NULLABLE_DEREFERENCE" ~hum:"Nullable Dereference"
 

infer/src/base/IssueType.mli

@@ -158,6 +158,10 @@ val eradicate_inconsistent_subclass_parameter_annotation : t
 
 val eradicate_inconsistent_subclass_return_annotation : t
 
+val eradicate_redundant_nested_class_annotation : t
+
+val eradicate_bad_nested_class_annotation : t
+
 val eradicate_nullable_dereference : t
 
 val eradicate_parameter_not_nullable : t

infer/src/nullsafe/ClassLevelAnalysis.ml

@@ -7,11 +7,12 @@
 
 open! IStd
 
-let log_issue ?proc_name ~issue_log ~loc ~trace ~severity ~nullsafe_extra issue_type error_message =
+let log_issue ?proc_name ~issue_log ~loc ~severity ~nullsafe_extra issue_type error_message =
   let extras =
     Jsonbug_t.{nullsafe_extra= Some nullsafe_extra; cost_polynomial= None; cost_degree= None}
   in
   let proc_name = Option.value proc_name ~default:Procname.Linters_dummy_method in
+  let trace = [Errlog.make_trace_element 0 loc error_message []] in
   Reporting.log_issue_external proc_name severity ~issue_log ~loc ~extras ~ltr:trace issue_type
     error_message
 
@@ -149,10 +150,11 @@ let make_meta_issue all_issues current_mode class_name =
   {issue_type; description; severity; meta_issue_info}
 
 
-let get_class_loc Struct.{java_class_info} =
+let get_class_loc source_file Struct.{java_class_info} =
   match java_class_info with
   | Some {loc} ->
-      loc
+      (* In rare cases location is not present, fall back to the first line of the file *)
+      Option.value loc ~default:Location.{file= source_file; line= 1; col= 0}
   | None ->
       Logging.die InternalError "java_class_info should be present for Java classes"
 
@@ -162,11 +164,7 @@ let report_meta_issues tenv source_file class_name class_struct class_info issue
   (* For purposes of aggregation, we consider all nested anonymous summaries as belonging to this class *)
   let current_mode = NullsafeMode.of_class tenv class_name in
   let summaries = AggregatedSummaries.ClassInfo.get_all_summaries class_info in
-  let class_loc =
-    get_class_loc class_struct
-    |> (* In rare cases location is not present, fall back to the first line of the file *)
-    Option.value ~default:Location.{file= source_file; line= 1; col= 0}
-  in
+  let class_loc = get_class_loc source_file class_struct in
   let all_issues =
     List.map summaries ~f:(fun Summary.{payloads= {nullsafe}} ->
         Option.value_map nullsafe ~f:(fun NullsafeSummary.{issues} -> issues) ~default:[] )
@@ -178,8 +176,7 @@ let report_meta_issues tenv source_file class_name class_struct class_info issue
   let package = JavaClassName.package class_name in
   let class_name = JavaClassName.classname class_name in
   let nullsafe_extra = Jsonbug_t.{class_name; package; meta_issue_info= Some meta_issue_info} in
-  let trace = [Errlog.make_trace_element 0 class_loc description []] in
-  log_issue ~issue_log ~loc:class_loc ~trace ~severity ~nullsafe_extra issue_type description
+  log_issue ~issue_log ~loc:class_loc ~severity ~nullsafe_extra issue_type description
 
 
 (* Optimization - if issues are disabled, don't bother analyzing them *)
@@ -189,14 +186,65 @@ let should_analyze_meta_issues () =
   || IssueType.eradicate_meta_class_is_nullsafe.enabled
 
 
-let analyze_class tenv source_file class_name class_info issue_log =
-  if should_analyze_meta_issues () then (
-    match Tenv.lookup tenv (Typ.JavaClass class_name) with
-    | Some class_struct ->
-        report_meta_issues tenv source_file class_name class_struct class_info issue_log
-    | None ->
-        Logging.debug Analysis Medium
-          "%a: could not load class info in environment: skipping class analysis@\n"
-          JavaClassName.pp class_name ;
-        issue_log )
+let analyze_meta_issues tenv source_file class_name class_struct class_info issue_log =
+  if should_analyze_meta_issues () then
+    report_meta_issues tenv source_file class_name class_struct class_info issue_log
   else issue_log
+
+
+let analyze_nullsafe_annotations tenv source_file class_name class_struct issue_log =
+  let loc = get_class_loc source_file class_struct in
+  let nullsafe_extra =
+    let package = JavaClassName.package class_name in
+    let class_name = JavaClassName.classname class_name in
+    Jsonbug_t.{class_name; package; meta_issue_info= None}
+  in
+  match NullsafeMode.check_problematic_class_annotation tenv class_name with
+  | Ok () ->
+      issue_log
+  | Error NullsafeMode.RedundantNestedClassAnnotation ->
+      let description =
+        Format.sprintf
+          "`%s`: the same @Nullsafe mode is already specified in the outer class, so this \
+           annotation can be removed."
+          (JavaClassName.classname class_name)
+      in
+      log_issue ~issue_log ~loc ~nullsafe_extra ~severity:Exceptions.Advice
+        IssueType.eradicate_redundant_nested_class_annotation description
+  | Error (NullsafeMode.NestedModeIsWeaker (ExtraTrustClass wrongly_trusted_classes)) ->
+      (* The list can not be empty *)
+      let example_of_wrongly_trusted_class = List.nth_exn wrongly_trusted_classes 0 in
+      let description =
+        Format.sprintf
+          "Nested classes cannot add classes to trust list if they are not in the outer class \
+           trust list. Remove `%s` from trust list."
+          (JavaClassName.classname example_of_wrongly_trusted_class)
+      in
+      log_issue ~issue_log ~loc ~nullsafe_extra ~severity:Exceptions.Warning
+        IssueType.eradicate_bad_nested_class_annotation description
+  | Error (NullsafeMode.NestedModeIsWeaker Other) ->
+      let description =
+        Format.sprintf
+          "`%s`: nested classes are disallowed to weaken @Nullsafe mode specified in the outer \
+           class. This annotation will be ignored."
+          (JavaClassName.classname class_name)
+      in
+      log_issue ~issue_log ~loc ~nullsafe_extra ~severity:Exceptions.Warning
+        IssueType.eradicate_bad_nested_class_annotation description
+
+
+let analyze_class_impl tenv source_file class_name class_struct class_info issue_log =
+  issue_log
+  |> analyze_meta_issues tenv source_file class_name class_struct class_info
+  |> analyze_nullsafe_annotations tenv source_file class_name class_struct
+
+
+let analyze_class tenv source_file class_name class_info issue_log =
+  match Tenv.lookup tenv (Typ.JavaClass class_name) with
+  | Some class_struct ->
+      analyze_class_impl tenv source_file class_name class_struct class_info issue_log
+  | None ->
+      Logging.debug Analysis Medium
+        "%a: could not load class info in environment: skipping class analysis@\n" JavaClassName.pp
+        class_name ;
+      issue_log

infer/src/nullsafe/NullsafeMode.ml

@@ -181,10 +181,6 @@ let of_procname tenv pname =
   of_class tenv (Typ.Name.Java.get_java_class_name_exn class_name)
 
 
-let is_in_trust_list t name =
-  match t with Strict | Default -> false | Local trust -> Trust.is_in_trust_list trust name
-
-
 let is_stricter_than ~stricter ~weaker =
   let strict_level mode = match mode with Default -> 0 | Local _ -> 1 | Strict -> 2 in
   match (stricter, weaker) with
@@ -194,6 +190,52 @@ let is_stricter_than ~stricter ~weaker =
       strict_level stricter > strict_level weaker
 
 
+type nested_class_annotation_problem =
+  | RedundantNestedClassAnnotation
+  | NestedModeIsWeaker of weak_type
+
+and weak_type = ExtraTrustClass of JavaClassName.t list | Other
+
+let check_problematic_class_annotation tenv user_defined_class =
+  if JavaClassName.is_anonymous_inner_class_name user_defined_class then
+    Logging.die InternalError
+      "check_problematic_class_annotation: should not be called for anonymous classes" ;
+  Option.value_map
+    (JavaClassName.get_outer_class_name user_defined_class)
+    ~f:(fun outer_class_name ->
+      (* Check if the mode of the nested class contradicts the outer's one or is redundant *)
+      let nested_mode = extract_mode_from_explicit_class_annotation tenv user_defined_class in
+      if equal Default nested_mode then (* Nested class is not explicitly annotated. *)
+        Ok ()
+      else
+        let outer_mode = of_class tenv outer_class_name in
+        if equal nested_mode outer_mode then Error RedundantNestedClassAnnotation
+        else
+          match (nested_mode, outer_mode) with
+          | Local (Trust.Only nested_trust_list), Local (Trust.Only outer_trust_list) ->
+              (* Special processing for pair of two Trust(some).
+                 The problem if when there is an attempt to introduce additional trust in nested that did not exist
+                 in outer.
+              *)
+              let extra_trusted_classes_in_nested =
+                JavaClassName.Set.diff nested_trust_list outer_trust_list
+              in
+              if not (JavaClassName.Set.is_empty extra_trusted_classes_in_nested) then
+                Error
+                  (NestedModeIsWeaker
+                     (ExtraTrustClass (JavaClassName.Set.elements extra_trusted_classes_in_nested)))
+              else Ok ()
+          | _ ->
+              if is_stricter_than ~stricter:outer_mode ~weaker:nested_mode then
+                Error (NestedModeIsWeaker Other)
+              else Ok () )
+    ~default:(Ok ())
+
+
+let is_in_trust_list t name =
+  match t with Strict | Default -> false | Local trust -> Trust.is_in_trust_list trust name
+
+
 let severity = function
   | Strict | Local _ ->
       (* Explicit @Nullsafe modes suppose that enforcement is made on CI side to not allow violations in the codebase.

infer/src/nullsafe/NullsafeMode.mli

@@ -46,3 +46,17 @@ val severity : t -> Exceptions.severity
     ERROR if and only if it is enforced. *)
 
 val pp : Format.formatter -> t -> unit
+
+type nested_class_annotation_problem =
+  | RedundantNestedClassAnnotation
+      (** Nested mode is explicitly annotated exactly like the outer one. *)
+  | NestedModeIsWeaker of weak_type  (** Attempt to relax the mode imposed in the outer class. *)
+
+and weak_type =
+  | ExtraTrustClass of JavaClassName.t list  (** Nested class has this extra list of classes *)
+  | Other
+
+val check_problematic_class_annotation :
+  Tenv.t -> JavaClassName.t -> (unit, nested_class_annotation_problem) result
+(** Given a (not anonymous) class name, check if there are semantic problems with [@Nullsafe] mode
+    annotation for this class *)

infer/tests/codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java

@@ -110,3 +110,57 @@ class Default {
     }
   }
 }
+
+class A {
+  public static String getString() {
+    return "";
+  }
+}
+
+class B {}
+
+class C {
+  public static String getString() {
+    return "";
+  }
+}
+
+@Nullsafe(value = Nullsafe.Mode.LOCAL, trustOnly = @Nullsafe.TrustList({A.class, B.class}))
+class TrustSome {
+
+  public String trustA_OK() {
+    return A.getString();
+  }
+
+  public String dontTrustC_Bad() {
+    return C.getString();
+  }
+
+  // Inherits mode from the outer, the same trust
+  class NotAnnotatedNested {
+    public String trustA_OK() {
+      return A.getString();
+    }
+
+    public String dontTrustC_Bad() {
+      return C.getString();
+    }
+  }
+
+  // This class does not trust A anymore
+  @Nullsafe(value = Nullsafe.Mode.LOCAL, trustOnly = @Nullsafe.TrustList({B.class}))
+  class CanRemoveFromTrustList {
+    public String dontTrustA_BAD() {
+      return A.getString();
+    }
+  }
+
+  // Lousy attempt to add a class C to trust list
+  // Should have a special issue suggesting to remove C from the list.
+  @Nullsafe(value = Nullsafe.Mode.LOCAL, trustOnly = @Nullsafe.TrustList({A.class, C.class}))
+  class CanNotAddToTrustList {
+    public String stillDontTrustC_BAD() {
+      return C.getString();
+    }
+  }
+}

infer/tests/codetoanalyze/java/nullsafe-default/issues.exp

@@ -267,13 +267,24 @@ codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dumm
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 27, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], NullsafeLocal$Nested$DeeplyNested, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "LocalTrustAll"
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 41, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], NullsafeLocal$NestedStrict, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "Strict"
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 49, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], NullsafeLocal$NestedExplicitLocal, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "LocalTrustAll"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 49, ERADICATE_REDUNDANT_NESTED_CLASS_ANNOTATION, no_bucket, ADVICE, [`NullsafeLocal$NestedExplicitLocal`: the same @Nullsafe mode is already specified in the outer class, so this annotation can be removed.], NullsafeLocal$NestedExplicitLocal, codetoanalyze.java.nullsafe_default
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 57, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], NullsafeStrict, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "Strict"
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 63, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], NullsafeStrict$Nested, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "Strict"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 71, ERADICATE_BAD_NESTED_CLASS_ANNOTATION, no_bucket, WARNING, [`NullsafeStrict$Nested$DeeplyNestedLocalIsStillStrict`: nested classes are disallowed to weaken @Nullsafe mode specified in the outer class. This annotation will be ignored.], NullsafeStrict$Nested$DeeplyNestedLocalIsStillStrict, codetoanalyze.java.nullsafe_default
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 71, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], NullsafeStrict$Nested$DeeplyNestedLocalIsStillStrict, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "Strict"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 80, ERADICATE_BAD_NESTED_CLASS_ANNOTATION, no_bucket, WARNING, [`NullsafeStrict$NestedLocalIsStillStrict`: nested classes are disallowed to weaken @Nullsafe mode specified in the outer class. This annotation will be ignored.], NullsafeStrict$NestedLocalIsStillStrict, codetoanalyze.java.nullsafe_default
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 80, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], NullsafeStrict$NestedLocalIsStillStrict, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "Strict"
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 87, ERADICATE_META_CLASS_CAN_BE_NULLSAFE, no_bucket, ADVICE, [Congrats! `Default` is free of nullability issues. Mark it `@Nullsafe(value = Nullsafe.Mode.LOCAL, trustOnly = @Nullsafe.TrustList({}))` to prevent regressions.], Default, codetoanalyze.java.nullsafe_default, issues: 0, curr_mode: "Default", promote_mode: "Strict"
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 94, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], Default$NestedLocal, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "LocalTrustAll"
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 106, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], Default$NestedLocal$DeeplyNestedStrict, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "Strict"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 114, ERADICATE_META_CLASS_CAN_BE_NULLSAFE, no_bucket, ADVICE, [Congrats! `A` is free of nullability issues. Mark it `@Nullsafe(value = Nullsafe.Mode.LOCAL, trustOnly = @Nullsafe.TrustList({}))` to prevent regressions.], A, codetoanalyze.java.nullsafe_default, issues: 0, curr_mode: "Default", promote_mode: "Strict"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 120, ERADICATE_META_CLASS_CAN_BE_NULLSAFE, no_bucket, ADVICE, [Congrats! `B` is free of nullability issues. Mark it `@Nullsafe(value = Nullsafe.Mode.LOCAL, trustOnly = @Nullsafe.TrustList({}))` to prevent regressions.], B, codetoanalyze.java.nullsafe_default, issues: 0, curr_mode: "Default", promote_mode: "Strict"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 122, ERADICATE_META_CLASS_CAN_BE_NULLSAFE, no_bucket, ADVICE, [Congrats! `C` is free of nullability issues. Mark it `@Nullsafe(value = Nullsafe.Mode.LOCAL, trustOnly = @Nullsafe.TrustList({}))` to prevent regressions.], C, codetoanalyze.java.nullsafe_default, issues: 0, curr_mode: "Default", promote_mode: "Strict"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 129, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], TrustSome, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "LocalTrustSome"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 140, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], TrustSome$NotAnnotatedNested, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "LocalTrustSome"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 152, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], TrustSome$CanRemoveFromTrustList, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "LocalTrustSome"
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 161, ERADICATE_BAD_NESTED_CLASS_ANNOTATION, no_bucket, WARNING, [Nested classes cannot add classes to trust list if they are not in the outer class trust list. Remove `C` from trust list.], TrustSome$CanNotAddToTrustList, codetoanalyze.java.nullsafe_default
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, Linters_dummy_method, 161, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], TrustSome$CanNotAddToTrustList, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "LocalTrustSome"
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.Default$NestedLocal$DeeplyNestedStrict.returningDefaultNotNullIsError():java.lang.String, 1, ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE, no_bucket, ERROR, [`Default.getString()`: `@NullsafeStrict` mode prohibits using values coming from non-strict classes without a check. Result of this call is used at line 107. Either add a local check for null or assertion, or make Default nullsafe strict.]
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.Default$NestedLocal.shouldBeNullsafeModeError():java.lang.String, 0, ERADICATE_RETURN_NOT_NULLABLE, no_bucket, ERROR, [`shouldBeNullsafeModeError()`: return type is declared non-nullable but the method returns `null`: null constant at line 96.]
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.NullsafeLocal$Nested$DeeplyNested.shouldBeNullsafeModeError():java.lang.String, 0, ERADICATE_RETURN_NOT_NULLABLE, no_bucket, ERROR, [`shouldBeNullsafeModeError()`: return type is declared non-nullable but the method returns `null`: null constant at line 29.]
@@ -285,6 +296,10 @@ codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyz
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.NullsafeStrict$Nested.returningDefaultNotNullIsError():java.lang.String, 1, ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE, no_bucket, ERROR, [`Default.getString()`: `@NullsafeStrict` mode prohibits using values coming from non-strict classes without a check. Result of this call is used at line 64. Either add a local check for null or assertion, or make Default nullsafe strict.]
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.NullsafeStrict$NestedLocalIsStillStrict.returningDefaultNotNullIsError():java.lang.String, 1, ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE, no_bucket, ERROR, [`Default.getString()`: `@NullsafeStrict` mode prohibits using values coming from non-strict classes without a check. Result of this call is used at line 81. Either add a local check for null or assertion, or make Default nullsafe strict.]
 codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.NullsafeStrict.returningDefaultNotNullIsError():java.lang.String, 1, ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE, no_bucket, ERROR, [`Default.getString()`: `@NullsafeStrict` mode prohibits using values coming from non-strict classes without a check. Result of this call is used at line 58. Either add a local check for null or assertion, or make Default nullsafe strict.]
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.TrustSome$CanNotAddToTrustList.stillDontTrustC_BAD():java.lang.String, 1, ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE, no_bucket, ERROR, [`C.getString()`: `@NullsafeLocal(trust=selected)` mode prohibits using values coming from non-nullsafe classes without a check. Result of this call is used at line 162. Either add a local check for null or assertion, or make C nullsafe.]
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.TrustSome$CanRemoveFromTrustList.dontTrustA_BAD():java.lang.String, 1, ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE, no_bucket, ERROR, [`A.getString()`: `@NullsafeLocal(trust=selected)` mode prohibits using values coming from non-nullsafe classes without a check. Result of this call is used at line 153. Either add a local check for null or assertion, or make A nullsafe.]
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.TrustSome$NotAnnotatedNested.dontTrustC_Bad():java.lang.String, 1, ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE, no_bucket, ERROR, [`C.getString()`: `@NullsafeLocal(trust=selected)` mode prohibits using values coming from non-nullsafe classes without a check. Result of this call is used at line 145. Either add a local check for null or assertion, or make C nullsafe.]
+codetoanalyze/java/nullsafe-default/NullsafeModeNestedClasses.java, codetoanalyze.java.nullsafe_default.TrustSome.dontTrustC_Bad():java.lang.String, 1, ERADICATE_UNCHECKED_USAGE_IN_NULLSAFE, no_bucket, ERROR, [`C.getString()`: `@NullsafeLocal(trust=selected)` mode prohibits using values coming from non-nullsafe classes without a check. Result of this call is used at line 135. Either add a local check for null or assertion, or make C nullsafe.]
 codetoanalyze/java/nullsafe-default/ParameterNotNullable.java, Linters_dummy_method, 20, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], ParameterNotNullable, codetoanalyze.java.nullsafe_default, issues: 37, curr_mode: "Default"
 codetoanalyze/java/nullsafe-default/ParameterNotNullable.java, Linters_dummy_method, 64, ERADICATE_META_CLASS_CAN_BE_NULLSAFE, no_bucket, ADVICE, [Congrats! `ParameterNotNullable$Builder` is free of nullability issues. Mark it `@Nullsafe(value = Nullsafe.Mode.LOCAL, trustOnly = @Nullsafe.TrustList({}))` to prevent regressions.], ParameterNotNullable$Builder, codetoanalyze.java.nullsafe_default, issues: 0, curr_mode: "Default", promote_mode: "Strict"
 codetoanalyze/java/nullsafe-default/ParameterNotNullable.java, Linters_dummy_method, 93, ERADICATE_META_CLASS_NEEDS_IMPROVEMENT, no_bucket, INFO, [], ParameterNotNullable$ConstructorCall, codetoanalyze.java.nullsafe_default, issues: 1, curr_mode: "Default"