False-positive: java:S1874 with Lombok @Getter

Rules and Languages Report False-positive / False-negative...
1
  • What language is this for? Java
  • Which rule? java:S1874
  • Why do you believe it’s a false-positive/false-negative? See the code and comments instead
  • Are you using: SonarQube Cloud + SonarQube for Eclipse in connected mode
  • How can we reproduce the problem?
package com.iqm.core;

import lombok.Getter;

public class SonarIssue {
	private static class SomeClass {
		/**
		 * @deprecated use {@link #setTimeout(long)} instead
		 * @param timeout
		 */
		@Deprecated
		void setTimeout(int timeout) {

		}

		void setTimeout(long timeout) {

		}
	}

	@Getter
	private static class AnotherClass {
		private long timeout;
	}

	public static void main(String[] args) {
		// here we get incorrect warning about deprecated method usage
		// while we call the method with the long argument which is not deprecated
		// in case AnotherClass will have getTimeout() without Lombok - the issue disappears
		new SomeClass().setTimeout(new AnotherClass().getTimeout());
	}
}
Sonar Community Roundup, November 15 - November 21
4

Hi @lrozenblyum !

Thank you for reporting this issue to us, and especially for providing this concise reproducer!

I can confirm that this is an FP, and that it is being triggered on the current version of the Java analyzer.

I created this ticket to track the problem: Jira

Unfortunately, this FP is likely caused by our analyzer not correctly identifying the getTimeout method that is generated by Lombok from the @Getter annotation. Hence other FPs might also be triggered in the context of the @Getter Lombok annotation.

Until we can properly address this, I can only recommend to you to mark the issue as False Positive in SonarQube Cloud. This should mute it for you until the code is modified again.

Best regards,

Anton

1 Like
5

Thanks @anton.haubner.

Lombok-powered code really makes SonarQube often confused.

Your idea 2.2 may solve a lot of issues related to Lombok (yet it definitely doesn’t look simple).