[false-negative]S2147 can not detect exceptions variable names are different, but processing of exceptions are exactly the same

SonarQube Server / Community Build
1

Affects Sonarqube Version:
Sonarqube version: 8.1.0.31237
sonar-scanner version: 4.2.0.1873-windows

Rule:
S2147: Catches should be combined

Description:
Unable to detect exceptions variable names are different, but processing of exceptions are exactly the same.
This rule is implemented in java-checks-6.2.0.21135-sources.jar!\org\sonar\java\checks\CombineCatchCheck.java.
This rule uses if (SyntacticEquivalence.areEquivalent(catchTree.block(), catchTreeToBeCompared.block())) { to determine whether exceptions handling in catch blocks are the same.
Therefore, catch blocks with different variable names but the same processing method cannot be detected.

Code Sample demonstrating the issue:
Example 1:

try {
    xmlRpcClientConfig.setGzipCompressing(configuration.getBoolean(XMLRPC_GZIP_COMPRESSION));
} catch (ConversionException ce) {
    this.debug(ce);
} catch (NoSuchElementException nsee) {
    this.debug(nsee);
}

Example 2:

try {
	CertificateFactory cf = CertificateFactory.getInstance("X.509");
	is = new FileInputStream(crlFile);
	crls = cf.generateCRLs(is);
} catch (IOException iex) {
	throw iex;
} catch (CRLException crle) {
	throw crle;
} catch (CertificateException ce) {
	throw ce;
}

Expected outcome:
false-negative

Running Sonarqube through:
command line

2

Hello,

I agree that we would want to report such issues in an ideal world, however, I’m really unsure how to do it from a static analysis point of view.

We could try to support the simple case that you propose if it happens to be a common pattern, but to me I’m not sure it’s worth it.

All in all, it seems like an acceptable limitation of the rule.
Of course, I’m eager to discuss it further if I missed something or you want to propose a solution.

Best,
Quentin