The Sonar issue is that csvLine can be assigned null from the first readLine and then dereferenced in the while check, causing NPE.