FALSE NEGATIVE: `java:S2589` misses a condition implied by the loop guard

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false negative in SonarQube 26.7.0 with sonar-java 8.34 when a condition inside a loop repeats the active loop bound.

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S2589

Minimal reproducer

class SpotbugsSonarqubeS2589LoopInvariant {
  void test() {
    for (int index = 0; index < 10; index++) {
      if (index < 10) System.out.println(index);
    }
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=spotbugs-sonarqube-reproducer -Dsonar.sources=spotbugs-sonarqube-s2589-fn-loop-invariant.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube produces no java:S2589 diagnostic.

Expected behavior

SonarQube should report java:S2589 at line 4 because index < 10 is guaranteed by the loop guard.

3

Hi @marktiwnzhao and thank you for your report.

This rule is partially supported (as you can see from your reports) in the old Java engine that is available on the community edition of SonarQube Server.

However we’re working on an improved version for our new engine that is available in the enterprise edition of SonarQube Server and SonarQube Cloud. We’ve a ticket for it.

Best regards,

Marco