FALSE NEGATIVE: `java:S2695` misses zero indices for additional JDBC methods

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false negative in SonarQube 26.7.0 with sonar-java 8.34 when index zero is passed to PreparedStatement.setAsciiStream() or ResultSet.updateInt().

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S2695

Minimal reproducer

import java.sql.PreparedStatement;
import java.sql.ResultSet;

class SpotbugsSonarqubeS2695IndexedApiMethods {
  void prepared(PreparedStatement statement) throws Exception {
    statement.setAsciiStream(0, null, 0);
  }

  void result(ResultSet result) throws Exception {
    result.updateInt(0, 1);
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=spotbugs-sonarqube-reproducer -Dsonar.sources=spotbugs-sonarqube-s2695-fn-indexed-api-methods.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube produces no java:S2695 diagnostic.

Expected behavior

SonarQube should report java:S2695 at lines 6 and 10 because JDBC parameter and column indices start at 1.

3

Hi @marktiwnzhao,

Thanks for your report, I’ve created JIRA ticket to fix this issue.