FALSE POSITIVE: java:S2259 ignores known boxed value equality

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false positive in SonarQube 26.7.0 with sonar-java 8.34 when two boxed Integer values are known to be equal.

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S2259

Minimal reproducer

class S2259IntegerEquals {
  void test() {
    Integer left = new Integer(42);
    Integer right = new Integer(42);
    if (!left.equals(right)) {
      Object object = null;
      object.toString();
    }
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=s2259-reproducer -Dsonar.sources=sonarqube-s2259-fp-integer-equals.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube reports sonarqube-s2259-fp-integer-equals.java:7: java:S2259: A NullPointerException could be thrown; object is nullable here.

Expected behavior

S2259 should not report this dereference because both Integer objects represent 42, so left.equals(right) is true.

4

Hi @marktiwnzhao and thank you for your report.

I can confirm the issue locally, I’ve created a ticket to track the issue.

Best regards,
Marco