Bug not detected RSPEC-6417

Rules and Languages Report False-positive / False-negative...
1

Hi Sonarqube Team,

The code below seems to contain the bug described in RSPEC-6417, however, the bug was not being detected during the scan. Any thoughts?

import java.util.ArrayList;
import java.util.List;
class Main {
    public static void main(String[] args) {
        List<String> lst = new ArrayList<>();
        lst.add("xhello");
        lst.add("world");
        showBug(lst);
    }
    public static void showBug(List<String> lst) {
        for (String element : lst) {
            if (element.startsWith("x")) {
                lst.remove(element);
            }
        }
    }
}

Sonarqube version 25.5
Lang: Java
SonarScanner version: 5.0.1.3006

Screenshot of code scan results

image
image913×387 53.7 KB

2

Hey there.

This rule is only available in SonarQube Server’s Developer Edition and higher. Since you mentioned v25.5, that means you’re using SonarQube’s Community Build, which does not include this rule.

The issue is correctly raised when using an edition including this rule.

image
image2804×1242 371 KB

When reporting false-negatives, please make sure the rule you’re looking at is activated in your project’s Quality Profile.