FALSE POSITIVE: java:S2259 ignores a known false object field

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false positive in SonarQube 26.7.0 with sonar-java 8.34 when a field of a fresh non-escaping object is assigned false before a branch.

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S2259

Minimal reproducer

final class S2259FieldStateCondition {
  static final class Box { boolean reachable; }

  void test() {
    Box box = new Box();
    box.reachable = false;
    if (box.reachable) {
      Object object = null;
      object.toString();
    }
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=s2259-reproducer -Dsonar.sources=sonarqube-s2259-fp-field-state-condition.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube reports sonarqube-s2259-fp-field-state-condition.java:9: java:S2259: A NullPointerException could be thrown; object is nullable here.

Expected behavior

S2259 should not report this dereference because the fresh local Box does not escape and box.reachable is assigned false immediately before the branch.

4

Hi @marktiwnzhao and thank you for your report.

I can reproduce the issue on the community edition of SonarQube which uses an old engine, but the issue is no longer present on enterprise one which uses a new engine.

You can try the latter by performing your analysis on SonarQube Cloud.

Best regards,
Marco