Inconsistency in HTTP_RESPONSE_SPLITTING Rule: Discrepancy in Violation Reporting with Nested Class

[soyodream]

Environment

Component	Version
Java	11.0.19
FindSecBugs	1.12.0

Problem

I have identified an inconsistency in the detection behavior of the HTTP_RESPONSE_SPLITTING rule in find-sec-bugs. In the first code case, the rule correctly reports a Buginstance. However, when introducing a nested class, as shown in the second code case, the rule fails to report the Buginstance. This behavior is inconsistent.

Code

code1

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

class PersistentCookie extends HttpServlet {
   protected void doGet(HttpServletRequest req, HttpServletResponse resp)
           throws ServletException, IOException {
       String email = req.getParameter("email");
       if (email != null && !email.equals("")) {
           setCookieFor1Week(email);
       }
   }
   private void setCookieFor1Week(String email) {
       Cookie cookie = new Cookie("emailCookie", email);
       cookie.setMaxAge(3600 * 24 * 7);
   }
}

code2

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

class PersistentCookie1 extends HttpServlet {
    Object anonWrap =
            new Object() {
                protected void doGet(HttpServletRequest req, HttpServletResponse resp)
                        throws ServletException, IOException {
                    String email = req.getParameter("email");
                    if (email != null && !email.equals("")) {
                        setCookieFor1Week(email);
                    }
                }
            };
    private void setCookieFor1Week(String email) {
        Cookie cookie = new Cookie("emailCookie", email);
        cookie.setMaxAge(3600 * 24 * 7);
    }
}