False negative : java:S4288 issue not raised on Spring @RestController component

[Colin]

This matches a previous request made here.

Extend java:S4288 to cover @RestController

(This isn’t so much a feature request as a suggestion for extending an existing rule; hopefully I’ve selected the correct category.) In brief: java:S4288 recommends constructor injection in place of autowiring fields in Spring controllers, services and repositories. For example, the following snippet (correctly) triggers the rule, @Controller public class DemoController { @Autowired // java:S4288 matches here private FooRepository fooRepository; } Unfortunately, the rule doesn’t match…

I’ve flagged this for attention by the right team internally.

Make sure you upgrade to SonarQube v9.9 LTS soon, not only to benefit from our Best LTS Ever™, but because soon we will systematically ask users to upgrade when they ask questions about earlier versions of SonarQube, which are now considered unsupported.