# False positive about java:S2259

**URL:** <https://community.sonarsource.com/t/false-positive-about-java-s2259/108369>\
**Category:** Report False-positive / False-negative...\
**Tags:** sonarqube, java\
**Created:** [February 1, 2024, 8:33am UTC](https://community.sonarsource.com/t/false-positive-about-java-s2259/108369 "2024-02-01T08:33:53Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![squestc](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/squestc/32/53966_2.png) [@squestc](https://community.sonarsource.com/u/squestc)\
**Post date:** [February 1, 2024, 8:33am UTC](https://community.sonarsource.com/t/false-positive-about-java-s2259/108369/1 "2024-02-01T08:33:54Z")

</div>

source code:  
 ![企业微信截图_17067762956216](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/f/0/f0e1f519a232290c067606c33fcd84d350a5164f.png)  
I think this is false positive  
java:S2259 Community Edition version 9.9.1 (build 69595)

---

<div class="post-metadata">

**Author:** ![angelo.buono](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/angelo.buono/32/44736_2.png) [@angelo.buono](https://community.sonarsource.com/u/angelo.buono)\
**Post date:** [February 5, 2024, 11:42am UTC](https://community.sonarsource.com/t/false-positive-about-java-s2259/108369/5 "2024-02-05T11:42:26Z")

</div>

Hello @squestc and welcome to the Sonar Community!

Thank you for reporting this issue. Unfortunately, we are aware of [many false positives raised by rule S2259](https://sonarsource.atlassian.net/browse/SONARJAVA-4598?jql=project%20%3D%20SONARJAVA%20AND%20issuetype%20%3D%20False-Positive%20AND%20text%20~%20%22S2259*%22) and the list contains already [[SONARJAVA-2317] - Jira](https://sonarsource.atlassian.net/browse/SONARJAVA-2317) that mentions the scenario in which `isBlank()` is used.

The rule S2259 is implemented on top of the Symbolic Execution engine that is not maintained, so mark it as won’t fix and ignore these issues for now. The good news is that a new engine, the _Dataflow Bug Detection_, is in development and will be soon available.

Cheers,  
Angelo

---

<div class="post-metadata">

**Author:** ![squestc](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/squestc/32/53966_2.png) [@squestc](https://community.sonarsource.com/u/squestc)\
**Post date:** [February 18, 2024, 2:54am UTC](https://community.sonarsource.com/t/false-positive-about-java-s2259/108369/7 "2024-02-18T02:54:22Z")

</div>

thanks a lot，respect

---

<div class="post-metadata">

**Author:** ![squestc](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/squestc/32/53966_2.png) [@squestc](https://community.sonarsource.com/u/squestc)\
**Post date:** [May 9, 2024, 1:54am UTC](https://community.sonarsource.com/t/false-positive-about-java-s2259/108369/8 "2024-05-09T01:54:30Z")

</div>

We have discovered that version 10.5.1 of SonarQube has been released. Therefore, when will the Dataflow Bug Detection feature be available? Currently, the false positives from the S2259 rule are causing us significant trouble

---

<div class="post-metadata">

**Author:** ![gab](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/gab/32/72206_2.png) [@gab](https://community.sonarsource.com/u/gab)\
**Post date:** [May 13, 2024, 6:53am UTC](https://community.sonarsource.com/t/false-positive-about-java-s2259/108369/11 "2024-05-13T06:53:44Z")

</div>

Hi @squestc,

Thank you for reporting the false positive.

We are considering significant changes around this topic for the next SonarQube LTS, which is expected in the last quarter of this year.

---

<div class="post-metadata">

**Author:** ![squestc](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/squestc/32/53966_2.png) [@squestc](https://community.sonarsource.com/u/squestc)\
**Post date:** [May 29, 2024, 8:09am UTC](https://community.sonarsource.com/t/false-positive-about-java-s2259/108369/12 "2024-05-29T08:09:25Z")

</div>

Another question, does SonarQube have a rule that can scan the SQL syntax within the @Select annotation for correctness? Looking forward to your response."

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [June 3, 2024, 3:06pm UTC](https://community.sonarsource.com/t/false-positive-about-java-s2259/108369/13 "2024-06-03T15:06:37Z")

</div>

Hi,

This is a new question, and a new question deserves a new thread.

Please include all the details.

&nbsp;  
Thx,  
Ann

---

<div class="post-metadata">

**Author:** ![squestc](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/squestc/32/53966_2.png) [@squestc](https://community.sonarsource.com/u/squestc)\
**Post date:** [November 21, 2024, 3:20am UTC](https://community.sonarsource.com/t/false-positive-about-java-s2259/108369/14 "2024-11-21T03:20:44Z")

</div>

Hello, has this issue been resolved? If so, in which version was it fixed? Thank You
