False Positive in SonarCloud with Lombok annotations: Unused “private” fields should be removed

[taomoh (Taoufik Mohdit)]

According to the thread below, the false positive issue about unused “private” fields was resolved in the v9.x series of SonarQube.
However it seems that it wasn’t resolved on SonarCloud. As I am still getting these false positives as of today (4 May 2023).

False positive with Lombok and @Data : Unused "private" fields should be removed

Need to confirm false positive unused private fields if this issue is already resolved. Code like this import lombok.Data; @Data public class CandidateScheduling { private String field10; private String field11; @Data public static class SomeProps { private String field20; private String field21; } ... ... Generates " Unused “private” fields should be removed " I confirmed my sonar.java.libraries and .binaries and checked the generated class to have gett…

[Colin]

Hey there.

Can you provide a reproducer of your specific code that is triggering the issue?

[taomoh (Taoufik Mohdit)]

Hello Colin,

Here is one example of a class triggering the issue on SonarCloud:

import java.util.UUID;
import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Getter;
import lombok.NoArgsConstructor;
import lombok.Setter;

@NoArgsConstructor
@AllArgsConstructor
@Builder
@Getter
@Setter
public class MyClass {
  private UUID id;
  private UUID secondId;
  private UUID thirdId;
}

Thanks!

[Margarita_Nedzelska]

Hello @taomoh,

Thanks for your message,

I tried to check your example and I can’t reproduce it. Issues are filtered out correctly because of Lombok annotations.

Could you, please, give me a little bit more context on how you’re running analysis and answer these questions:

1. Provide analysis log
2. Provide properties used for the analysis
3. Are you using Gradle or maven scanners?
4. Are you using automatic analysis?

Regards,
Margarita

[taomoh (Taoufik Mohdit)]

Thanks @Margarita_Nedzelska for looking into this for me.

1. From the logs: [INFO] SonarQube version: 8.0.0.40668. So SonarCloud seems to be using a version older than SonarQube 9.x where the issue was fixed. Could this be the cause of the problem?

2. Properties
   sonar.language=java
   sonar.java.coveragePlugin=jacoco

3. Using maven scanner. From the logs: Downloaded from central: https://repo.maven.apache.org/maven2/org/sonarsource/scanner/api/sonar-scanner-api/2.16.2.588/sonar-scanner-api-2.16.2.588.jar

4. I believe we don’t use automatic analysis. Sonar scan is triggered in the CI/CD pipeline using mvn sonar:sonar command

Taoufik

[Margarita_Nedzelska]

Hi @taomoh,
Thanks for the message.

SonarCloud should use the latest version of the analyzer, so it couldn’t be there. Is it possible to share a full log with me (in private messages)?

Can you reproduce the issue locally? (running mvn sonar:sonar locally)

Have you built the project before analyzing it? Where are your class files situated?

I’ve tried to reproduce the issue in SonarCloud: SonarCloud. But there is no FP there.

So waiting for some additional information to investigate it further.

Regards,
Margarita

[taomoh (Taoufik Mohdit)]

Hi Margarita,

From the logs it does look like my project scan is using SonarQube 8.0.0.40601. Happy to share the logs in a private message. How do I do that? I don’t see any option on sonarsource to message you privately.

I can’t reproduce the issue locally, using SonarQube latest version (10.0.0.68432). The scan doesn’t show the false positives and rightly so. I would have liked to use version 8.x but unfortunately I couldn’t, as the 8.x official images on Docker Hub are only available in AMD and my machine is ARM.

I think the key question here is why my SonarCloud scan is using an old version of SonarQube? (as the logs suggest)

Thanks,
Taoufik