Reason why findsecbugs report the vulnerabilities in the code segment of the imported library

Question

As shown in the picture below, line 18 shows that a hard-coded vulnerability was scanned.

But it does not report the issue when I import this flagged module in other files. And strangely, it also reports this problem when I remove the flagged module.

Please help me fix this.

Answer 1

The issue was investigate here: https://github.com/find-sec-bugs/find-sec-bugs/issues/617#issuecomment-741505146

The original poster (@j0ck) found the issue. It was code weaving altering the bytecode and probably modifying the source line metadata.