False Negative for rule RSPEC-1226

Rules and Languages Report False-positive / False-negative...
, ,
1

Hi Team,

The code snippet below violates RSPEC-1226, but SonarQube scans of this code snippet don’t pick up the bug rule violation.

Code snippet:

import java.util.Arrays;
import java.util.List;

class BuggyCode {

  public static void main(String[] args) {
    doTheThing("hello", 123, Arrays.asList("apple", "banana", "cherry"));
  }

  public static void doTheThing(String str, int i, List<String> strings) {
    str = Integer.toString(i);
    for (String s : strings) {

      s = "hello world";
    }
  }
}

screenshot of the code snippet scan result in sonarqube:

image
image1584×461 34.9 KB

Scanning information:
Sonarqube version: 10.7.0.96327
SonarScanner version: 5.0.1.3006
SonarQube Community Edition
Related language: Java

Note: To recreate, you can use sonar-scanner to scan the given file. In our case, scans were performed using SonarQube versions 9.9 and 10.7, and neither of the scans consistently detected the bug rule violation.

Thanks for your time and consideration.

2

Hey there.

Thanks for the report. As I’ve noted in your other reports, please reproduce this using the latest version of SonarQube Community Build – 25.5.