False negative java:S3400 — constant-returning method not detected

Rules and Languages Report False-positive / False-negative...
1

Product: SonarQube Community Build 26.7.0.124771 (default “Sonar way” profile)

Type: false negative.

Explanation (expected vs actual): S3400 flags methods that invariably return the same constant value. The method below still returns the identical constant "fixed" on every invocation: Collections.singletonList("fixed").get(0) is a pure identity wrap of the literal, but detection keys on the return expression being a literal/constant expression, so the indirection silences it while the code smell (and the rule’s prescribed fix: declare a constant) is unchanged.

class ConstantMethod {
    static String label() {
        return "fixed";          // Noncompliant — S3400 reported (baseline)
    }
}

Variant — not reported (still invariably returns the same constant):

class ConstantMethod {
    static String label() {
        return java.util.Collections.singletonList("fixed").get(0);   // same constant; no S3400
    }
}

Extending the check is probably not practical here. A documentation tweak might be the better fix: the RSPEC says “a method invariably returning the same value should declare a constant”, which this variant satisfies verbatim, but the detection only matches constant expressions. Narrowing the RSPEC wording would keep the docs and the implementation consistent. :slight_smile:

2

Hello @MarkLee131,

Thank you for the clear example and for raising the documentation concern.

Yes Java rule S3400 currently detects methods with a single return statement whose returned expression is a direct literal, such as "fixed". It does not attempt to evaluate indirect expressions such as Collections.singletonList("fixed").get(0), even where the expression always produces the same value.

Your observation about the rule description is valid: its current wording can suggest a broader scope than the implementation provides. I will flag this for attention by the relevant development team, both for their assessment of the detection scope and for possible clarification of the rule documentation.

Best regards,

Stevan