A false negative about the rule S4423

Rules and Languages Report False-positive / False-negative...
1

Context Information:

  • Java
  • Rule: S4423
  • Why do you believe it’s a false-negative?
    • The following code example contains a bug that violates rule S4423. At line 6, two weak protocols are used. This case is considered a false negative because the rule should have flagged it but did not.
  • Version: sonarqube-25.6.0.109173
import java.security.NoSuchAlgorithmException;
import javax.net.ssl.SSLContext;

public class Main {
  public static void main(String[] args) {
    String[] protocols = new String[] {"TLSv1.1", "TLSv1"}; // should report S4423 warings here, but no warnings
    try {
      for (String protocol : protocols) {
        SSLContext context = SSLContext.getInstance(protocol);
        System.out.println(context.getProvider());
      }
    } catch (NoSuchAlgorithmException e) {
        e.printStackTrace();
    }
  }
}
4

Hi @Belle,

Thanks a lot for reporting this, it seems like an FN indeed. This might be due to how we modelized loops within the detection logic.

I am going to create the necessary action items to fix this.

Cheers,

Loris