FALSE NEGATIVE: `java:S2589` misses a condition fixed by an exception path

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false negative in SonarQube 26.7.0 with sonar-java 8.34 when entering a catch block proves the boolean guard used before the throwing call.

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S2589

Minimal reproducer

class SpotbugsSonarqubeS2589ExceptionPath {
  int parse(boolean enabled, String input) {
    try {
      if (enabled) Integer.parseInt(input);
    } catch (NumberFormatException exception) {
      if (!enabled) return 1;
    }
    return 0;
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=spotbugs-sonarqube-reproducer -Dsonar.sources=spotbugs-sonarqube-s2589-fn-exception-path.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube produces no java:S2589 diagnostic.

Expected behavior

SonarQube should report java:S2589 at line 6 because enabled must be true for Integer.parseInt() to have thrown.

3

Hi @marktiwnzhao and thank you for your report.

This rule is partially supported (as you can see from your reports) in the old Java engine that is available on the community edition of SonarQube Server.

However we’re working on an improved version for our new engine that is available in the enterprise edition of SonarQube Server and SonarQube Cloud. We’ve a ticket for it.

Best regards,

Marco