Implemented the JSON problem handler. Resolved #131.

Refactored JSON parser tests.
Eliminated a significant number of compile, PMD, and Spotbugs warnings.

.github/workflows/build.yml

@@ -75,6 +75,11 @@ jobs:
     - name: Perform CodeQL Analysis
       if: github.event_name == 'push'
       uses: github/codeql-action/analyze@46ed16ded91731b2df79a2893d3aea8e9f03b5c4
+    - name: Upload CodeQL SARIF file
+      uses: github/codeql-action/upload-sarif@46ed16ded91731b2df79a2893d3aea8e9f03b5c4
+      if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref_name == 'develop'
+      with:
+        token: ${{ secrets.COMMIT_TOKEN }}
     - name: Test Website
       run: |
         # this needs to be run as a second build to ensure source is fully generated by the previous step

core/src/main/java/gov/nist/secauto/metaschema/core/datatype/markup/flexmark/XmlMarkupParser.java

@@ -154,7 +154,8 @@ private void parseStartElement(XMLEventReader2 reader, StartElement start, Strin
     QName name = start.getName();
     buffer.append('<')
         .append(name.getLocalPart());
-    for (Attribute attribute : CollectionUtil.toIterable(start.getAttributes())) {
+    for (Attribute attribute : CollectionUtil.toIterable(
+        ObjectUtils.notNull(start.getAttributes()))) {
       buffer
           .append(' ')
           .append(attribute.getName().getLocalPart())

core/src/main/java/gov/nist/secauto/metaschema/core/model/xml/XmlUtil.java → core/src/main/java/gov/nist/secauto/metaschema/core/model/util/XmlUtil.java

@@ -24,14 +24,16 @@
  * OF THE RESULTS OF, OR USE OF, THE SOFTWARE OR SERVICES PROVIDED HEREUNDER.
  */
 
-package gov.nist.secauto.metaschema.core.model.xml;
+package gov.nist.secauto.metaschema.core.model.util;
 
 import java.io.IOException;
 import java.net.URL;
 
 import javax.xml.transform.Source;
 import javax.xml.transform.stream.StreamSource;
 
+import edu.umd.cs.findbugs.annotations.NonNull;
+
 public final class XmlUtil {
 
   private XmlUtil() {
@@ -51,7 +53,8 @@ private XmlUtil() {
    *           if an error occurred while creating the underlying stream
    */
   @SuppressWarnings("resource") // user of source is expected to close
-  public static StreamSource getStreamSource(URL url) throws IOException {
+  @NonNull
+  public static StreamSource getStreamSource(@NonNull URL url) throws IOException {
     return new StreamSource(url.openStream(), url.toString());
   }
 }

core/src/main/java/gov/nist/secauto/metaschema/core/util/CollectionUtil.java

@@ -76,7 +76,7 @@ public static <T> Stream<T> toStream(@NonNull Iterator<T> iterator) {
    */
   @NonNull
   public static <T> Iterable<T> toIterable(@NonNull Stream<T> stream) {
-    return toIterable(stream.iterator());
+    return toIterable(ObjectUtils.notNull(stream.iterator()));
   }
 
   /**

core/src/main/java/module-info.java

@@ -51,7 +51,7 @@
   requires org.apache.commons.text;
   requires org.apache.logging.log4j;
   requires org.apache.xmlbeans;
-  requires org.json;
+  requires transitive org.json;
   requires org.jsoup;
 
   requires transitive com.fasterxml.jackson.databind;
@@ -67,7 +67,7 @@
   requires flexmark.ext.tables;
   requires transitive flexmark.ext.typographic;
   requires flexmark.html2md.converter;
-  requires flexmark.util.ast;
+  requires transitive flexmark.util.ast;
   requires flexmark.util.builder;
   requires flexmark.util.collection;
   requires flexmark.util.data;

databind/src/main/java/gov/nist/secauto/metaschema/databind/DynamicBindingContext.java

@@ -44,8 +44,7 @@
 import edu.umd.cs.findbugs.annotations.Nullable;
 
 /**
- * Used to dynamically generate, compile, and load a set of Metaschema annotated
- * Java classes.
+ * Used to dynamically generate, compile, and load a set of Metaschema annotated Java classes.
  */
 public class DynamicBindingContext
     extends DefaultBindingContext {

databind/src/main/java/gov/nist/secauto/metaschema/databind/codegen/DefaultMetaschemaClassFactory.java

@@ -117,11 +117,12 @@ class DefaultMetaschemaClassFactory implements IMetaschemaClassFactory {
   private final ITypeResolver typeResolver;
 
   /**
-   * Get a new instance of the this class generation factory that uses the provided
-   * {@code typeResolver}.
+   * Get a new instance of the this class generation factory that uses the
+   * provided {@code typeResolver}.
    *
    * @param typeResolver
-   *          the resolver used to generate type information for Metasschema constructs
+   *          the resolver used to generate type information for Metasschema
+   *          constructs
    * @return the new class factory
    */
   @NonNull
@@ -130,11 +131,12 @@ public static DefaultMetaschemaClassFactory newInstance(@NonNull ITypeResolver t
   }
 
   /**
-   * Construct a new instance of the this class ganeration factory that uses the provided
-   * {@code typeResolver}.
+   * Construct a new instance of the this class ganeration factory that uses the
+   * provided {@code typeResolver}.
    *
    * @param typeResolver
-   *          the resolver used to generate type information for Metasschema constructs
+   *          the resolver used to generate type information for Metasschema
+   *          constructs
    */
   protected DefaultMetaschemaClassFactory(@NonNull ITypeResolver typeResolver) {
     this.typeResolver = typeResolver;
@@ -165,6 +167,8 @@ public IGeneratedMetaschemaClass generateClass(
         module.getFieldDefinitions().stream());
 
     Set<String> classNames = new HashSet<>();
+
+    @SuppressWarnings("PMD.UseConcurrentHashMap") // map is unmodifiable
     Map<IFlagContainer, IGeneratedDefinitionClass> definitionProductions
         = ObjectUtils.notNull(globalDefinitions
             // Get type information for assembly and field definitions.
@@ -266,8 +270,8 @@ public IGeneratedClass generatePackageInfoClass(
   }
 
   /**
-   * Creates and configures a builder, for a Metaschema module, that can be used to generate a Java
-   * class.
+   * Creates and configures a builder, for a Metaschema module, that can be used
+   * to generate a Java class.
    *
    * @param metaschema
    *          a parsed Metaschema module
@@ -417,13 +421,14 @@ protected TypeSpec.Builder newClassBuilder(
   }
 
   /**
-   * Creates and configures a builder, for a Metaschema model definition, that can be used to generate
-   * a Java class.
+   * Creates and configures a builder, for a Metaschema model definition, that can
+   * be used to generate a Java class.
    *
    * @param typeInfo
    *          the type information for the class to generate
    * @param isChild
-   *          {@code true} if the class to be generated is a child class, or {@code false} otherwise
+   *          {@code true} if the class to be generated is a child class, or
+   *          {@code false} otherwise
    * @return the class builder
    * @throws IOException
    *           if an error occurred while building the Java class
@@ -466,13 +471,15 @@ protected TypeSpec.Builder newClassBuilder(
   }
 
   /**
-   * Generate the contents of the class represented by the provided {@code builder}.
+   * Generate the contents of the class represented by the provided
+   * {@code builder}.
    *
    * @param typeInfo
    *          the type information for the class to build
    * @param builder
    *          the builder to use for generating the class content
-   * @return the set of additional definitions for which child classes need to be generated
+   * @return the set of additional definitions for which child classes need to be
+   *         generated
    */
   protected Set<IFlagContainer> buildClass(
       @NonNull IAssemblyDefinitionTypeInfo typeInfo,
@@ -503,13 +510,15 @@ protected Set<IFlagContainer> buildClass(
   }
 
   /**
-   * Generate the contents of the class represented by the provided {@code builder}.
+   * Generate the contents of the class represented by the provided
+   * {@code builder}.
    *
    * @param typeInfo
    *          the type information for the class to build
    * @param builder
    *          the builder to use for generating the class content
-   * @return the set of additional definitions for which child classes need to be generated
+   * @return the set of additional definitions for which child classes need to be
+   *         generated
    */
   protected Set<IFlagContainer> buildClass(
       @NonNull IFieldDefinitionTypeInfo typeInfo,
@@ -529,13 +538,15 @@ protected Set<IFlagContainer> buildClass(
   }
 
   /**
-   * Generate the contents of the class represented by the provided {@code builder}.
+   * Generate the contents of the class represented by the provided
+   * {@code builder}.
    *
    * @param typeInfo
    *          the type information for the class to build
    * @param builder
    *          the builder to use for generating the class content
-   * @return the set of additional definitions for which child classes need to be generated
+   * @return the set of additional definitions for which child classes need to be
+   *         generated
    */
   @NonNull
   protected Set<IFlagContainer> buildClass(
@@ -627,7 +638,8 @@ protected Set<IFlagContainer> buildClass(
   }
 
   /**
-   * Build the core property annotations that are common to all Metaschema classes.
+   * Build the core property annotations that are common to all Metaschema
+   * classes.
    *
    * @param typeInfo
    *          the type information for the Java property to build

databind/src/main/java/gov/nist/secauto/metaschema/databind/io/AbstractDeserializer.java

@@ -62,13 +62,14 @@ public abstract class AbstractDeserializer<CLASS>
    * @param bindingContext
    *          the binding context used to supply bound Java classes while writing
    * @param classBinding
-   *          the bound class information for the Java type this deserializer is operating on
+   *          the bound class information for the Java type this deserializer is
+   *          operating on
    */
   protected AbstractDeserializer(@NonNull IBindingContext bindingContext, @NonNull IAssemblyClassBinding classBinding) {
     super(bindingContext, classBinding);
   }
 
-  @Override
+  @NonNull
   public IConstraintValidationHandler getConstraintValidationHandler() {
     synchronized (this) {
       if (constraintValidationHandler == null) {

databind/src/main/java/gov/nist/secauto/metaschema/databind/io/AbstractProblemHandler.java

@@ -0,0 +1,53 @@
+/*
+ * Portions of this software was developed by employees of the National Institute
+ * of Standards and Technology (NIST), an agency of the Federal Government and is
+ * being made available as a public service. Pursuant to title 17 United States
+ * Code Section 105, works of NIST employees are not subject to copyright
+ * protection in the United States. This software may be subject to foreign
+ * copyright. Permission in the United States and in foreign countries, to the
+ * extent that NIST may hold copyright, to use, copy, modify, create derivative
+ * works, and distribute this software and its documentation without fee is hereby
+ * granted on a non-exclusive basis, provided that this notice and disclaimer
+ * of warranty appears in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED 'AS IS' WITHOUT ANY WARRANTY OF ANY KIND, EITHER
+ * EXPRESSED, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY
+ * THAT THE SOFTWARE WILL CONFORM TO SPECIFICATIONS, ANY IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND FREEDOM FROM
+ * INFRINGEMENT, AND ANY WARRANTY THAT THE DOCUMENTATION WILL CONFORM TO THE
+ * SOFTWARE, OR ANY WARRANTY THAT THE SOFTWARE WILL BE ERROR FREE.  IN NO EVENT
+ * SHALL NIST BE LIABLE FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DIRECT,
+ * INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES, ARISING OUT OF, RESULTING FROM,
+ * OR IN ANY WAY CONNECTED WITH THIS SOFTWARE, WHETHER OR NOT BASED UPON WARRANTY,
+ * CONTRACT, TORT, OR OTHERWISE, WHETHER OR NOT INJURY WAS SUSTAINED BY PERSONS OR
+ * PROPERTY OR OTHERWISE, AND WHETHER OR NOT LOSS WAS SUSTAINED FROM, OR AROSE OUT
+ * OF THE RESULTS OF, OR USE OF, THE SOFTWARE OR SERVICES PROVIDED HEREUNDER.
+ */
+
+package gov.nist.secauto.metaschema.databind.io;
+
+import gov.nist.secauto.metaschema.databind.model.IBoundNamedInstance;
+
+import java.io.IOException;
+import java.util.Collection;
+
+import edu.umd.cs.findbugs.annotations.NonNull;
+
+public abstract class AbstractProblemHandler implements IProblemHandler {
+
+  protected static <TYPE extends IBoundNamedInstance> void applyDefaults(
+      @NonNull Object targetObject,
+      @NonNull Collection<TYPE> unhandledInstances) throws IOException {
+    for (TYPE instance : unhandledInstances) {
+      Object value;
+      try {
+        value = instance.defaultValue();
+      } catch (BindingException ex) {
+        throw new IOException(ex);
+      }
+      if (value != null) {
+        instance.setValue(targetObject, value);
+      }
+    }
+  }
+}

databind/src/main/java/gov/nist/secauto/metaschema/databind/io/DefaultBoundLoader.java

@@ -385,8 +385,11 @@ protected IDocumentNodeItem loadAsNodeItemInternal(@NonNull BufferedInputStream
   }
 
   @NonNull
-  protected IDocumentNodeItem deserializeToNodeItem(@NonNull Class<?> clazz, @NonNull Format format,
-      @NonNull BufferedInputStream bis, @NonNull URI documentUri) throws IOException {
+  protected IDocumentNodeItem deserializeToNodeItem(
+      @NonNull Class<?> clazz,
+      @NonNull Format format,
+      @NonNull BufferedInputStream bis,
+      @NonNull URI documentUri) throws IOException {
     try {
       bis.reset();
     } catch (IOException ex) {