There are many detectors in SpotBugs (mostly find-sec-bugs, but also fb-contrib) that are more an indicator to the developer to come check something out and make sure there isn't an issue. These detectors flag a particular pattern and can't really be expected to go much deeper. Here is an example:
out.println(
"<input type=hidden name=sessionId value="
+ escapeHtml(sessionId) + ">");
Here, out is the Writer for the HttpServletResponse in a servlet and SpotBugs flags this with XSS_SERVLET. The point here is that an unsanitized input (sessionId) could allow some sort of cross-site scripting attack: there is nothing wrong with what SpotBugs has done.
My question is, once I've come into this code and said, yes, we are sanitizing this input, this is safe, I don't see a way to tell SpotBugs I've done so.
I know we could "make the code better", but sometimes that's not an option. We could certainly annotate (or use XML config) the method to ignore XSS_SERVLET, but I feel like that opens the door for someone to come along and add a real vulnerability later. From what I can see there is no way to annotate an individual line, so I'm wondering how others handle this.