FALSE NEGATIVE: `java:S2390` misses a nested subclass initialization cycle that observes a default v

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false negative in SonarQube 26.7.0 with sonar-java 8.34 when a nested subclass initialization cycle reads a superclass field before its initializer runs.

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S2390

Minimal reproducer

class NestedInitializationCycle {
  static class Child extends NestedInitializationCycle {
    static int observed = NestedInitializationCycle.later;
  }

  static int first = Child.observed;
  static int later = 42;

  public static void main(String[] args) {
    System.out.println(first);
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=spotbugs-sonarqube-reproducer -Dsonar.sources=spotbugs-sonarqube-s2390-fn-nested-subclass-initialization.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube produces no java:S2390 diagnostic.

Expected behavior

SonarQube should report java:S2390 at line 6 because initializing first actively initializes Child, which reads later before later = 42 runs and therefore observes the default value 0.

3

Hello @marktiwnzhao,

Thanks for your report! We intentionally don’t raise issues for the case of nested classes. You can read about it in this post. Probably we should update our documentation to reflect this exception.