Fix building in IntelliJ IDEA

[ppkarwasz]

For an improved supply chain security (see XDev for example automatic annotation processor discovery should be disabled and annotation processors should be explicitly listed on the command line. In Maven this can be done:

• If the list of processors is not empty, by adding an <annotationProcessors> configuration element.
• If the list of processors is empty, the above setting will cause an invalid -processor '' argument to be passed to the compiler. To fix that -proc:none needs to be provided.

The above procedure breaks IntelliJ IDEA compilation, since seeing a -proc:none not only disables annotation processing, but also causes IDEA to ignore the provided --processor-path. We don't have annotation processors, but we have a compiler Plugin, which needs to be on the annotation processor path.

This PR solves these compatibility problems, by removing both the -proc:none and -processor arguments and de factoenables the automatic discovery of annotation processors. It adds a comment to re-enable the annotationProcessor element if an annotation processor is added in the future.

Closes#199

[dwalluck]

So, since no processors existed in the first place, the flag was unnecessary for security, right?

[dwalluck]

Here is one more IDEA puzzle for you: Every time I restart IDEA, I have to re-enable jspecify as the default null annotation (all existing uses are underlined). It always goes back to its own annotations by default.

[ppkarwasz]

So, since no processors existed in the first place, the flag was unnecessary for security, right?

error_prone_core has around 80 dependencies. Without -proc:none it is theoretically possible for someone to add a malicious annotation processor to one of those dependencies. I don't imagine it happening anytime soon, but supply chain attacks are getting popular.

Here is one more IDEA puzzle for you: Every time I restart IDEA, I have to re-enable jspecify as the default null annotation (all existing uses are underlined). It always goes back to its own annotations by default.

I am not even sure, where to find the option to set that.

[jeremylong]

@ppkarwasz I mentioned annotation processor attacks in my 2023 talk at BlackHat and AppSec USA (same talk at both - I think the AppSec one might have been a little better as it was my second time giving the talk):

• https://www.youtube.com/watch?v=GXdHoxDgAYI
• https://www.youtube.com/watch?v=Gtsyi41MUG0

[jeremylong]

LGTM

[dwalluck]

I am not even sure, where to find the option to set that.

@ppkarwasz I think I am using this plugin https://plugins.jetbrains.com/plugin/9418-nullability-annotations-inspection