FALSE NEGATIVE: `java:S3065` misses reversed floating-point min/max bounds

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false negative in SonarQube 26.7.0 with sonar-java 8.34 when reversed bounds are passed to the double overloads of Math.max and Math.min.

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S3065

Minimal reproducer

class SpotbugsSonarqubeS3065FloatingPointMinMax {
  double clamp(double value) {
    return Math.max(1.0, Math.min(0.0, value));
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=spotbugs-sonarqube-reproducer -Dsonar.sources=spotbugs-sonarqube-s3065-fn-floating-point-min-max.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube produces no java:S3065 diagnostic.

Expected behavior

SonarQube should report java:S3065 at line 3 because the min/max bounds are reversed. For every non-NaN input, the expression evaluates to 1.0 (and NaN propagates for a NaN input).

5

Hi @marktiwnzhao ,

thank you for your report and the reproducer example.

Indeed, the analysis currently does not raise here, even though raising an issue would follow the intention of the rule, making this an FN.

This is linked to float/double values not being supported for this rule, a ticket to track this has been created: https://sonarsource.atlassian.net/browse/JAVASE-263

Best regards

Anton