False positive for java:S1172 in a graphQL Api service

[LilianeTop (Liliane)]

Make sure to read this post before raising a thread here:

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Then tell us:

• What language is this for?
  Java
• Which rule?
  java:S1172
• Why do you believe it’s a false-positive/false-negative?
  It is a graphQL specification to pass the parent object of the child object which is getting resolved and hence not an unused parameter.
• Are you using =>
  SonarLint 8.1.0.65508 SonarSource within IntelliJ 2022.3.1 (Ultimate version)
• How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)

/**
     * Do NOT remove the Author author parameter as it is required for graphql resolver
     * It is a graphQL specification to pass the parent object of the child object which is getting resolved.
     * Author is the parent.
     * @param author
     * @param env
     * @return AuthorProfile
     */
    public AuthorProfile profile(final Author author, final DataFetchingEnvironment env) {

        return authorService.getAuthorProfile(env);

    }

To be able to reproduce this problem I have to give you the repo .

[Marco_Kaufmann]

Hi Liliane,

Welcome to the community, and thanks for reporting!

Just to give us some context: was this code generated by a tool from a GraphQL API specification? Or the other way: you wrote it manually, and the purpose is further processing by GraphQL tools, e.g., to generate client/server stubs, documentation et c.?

Anyway, since the need for the additional parameters comes from outside Java and outside your code, we have no chance to recognize that there’s a special semantic here and that the rule should not be applied. The only thing you can do is to suppress the rule for the respective methods, classes or files. In case this is generated code, it should not be checked anyway, because you have no control over it.

The rule can be turned off via @SuppressWarnings("java:S1172") at the method or class level. In case you need some more information, you can find it in our SonarQube Docs → Turning issues off.

[LilianeTop (Liliane)]

Yes i wrote it manually and indeed the purpose is to parse the objects.
I did solve it by using the SuppressWarnings.
Thank you for responding.