False positive: "andExpect" is not detected as an assertion in java:S2699

[ldenos (Lorie DEN OS)]

• Version used
  SonarQube Community EditionVersion 9.2.4 (build 50792)
  SonarLint 7.1 in Eclipse

• Minimal code sample
  Rule java:S2699 does not detect the “andExpect” in this sample:

@Test
    public void getUsersFavorites_wrongToken() throws Exception {
        mockMvc.perform(post("/statistics/favorite-contracts") //
                .content(asJson(Set.of(userMe.getId(), userClarkKent.getId())))//
                .headers(token("contracts.assign")) //
                .contentType(MediaType.APPLICATION_JSON)) //
                .andExpect(status().isForbidden());
    } 

although it detects it when we simplify the “headers” part like this:

private HttpHeaders tokenContractsAssign() {
        return token("contracts.assign");
    }

    @Test
    public void getUsersFavorites_wrongToken() throws Exception {
        mockMvc.perform(post("/statistics/favorite-contracts") //
                .content(asJson(Set.of(userMe.getId(), userClarkKent.getId())))//
                .headers(tokenContractsAssign()) //
                .contentType(MediaType.APPLICATION_JSON)) //
                .andExpect(status().isForbidden());
    }

Could you address this? Thanks in advance!

[Quentin (Quentin Jaquier)]

Hello @ldenos

First, can you double-check that the types of andExpect is in both case exactly org.springframework.test.web.servlet.ResultActions#andExpect? If it’s not exactly the same type, we might have something to adjust on our side.

If it is the same, this problem is typically due to incomplete semantics. I created a ticket to not report false positive for such cases: SONARJAVA-4144.

Still, incomplete semantic means that your project is probably somehow missconfigured.
Have a look at the logs of the analysis, you might see something like:

Unresolved imports/types have been detected during analysis. Enable DEBUG mode to see them.

It should help you to better understand what is happening.

Best,
Quentin