FALSE POSITIVE: `java:S3039` rejects `substring(string.length())`

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false positive in SonarQube 26.7.0 with sonar-java 8.34 when substring() starts exactly at the string length.

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S3039

Minimal reproducer

class SpotbugsSonarqubeS3039SubstringAtLength {
  String emptySuffix(String value) {
    return value.substring(value.length());
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=spotbugs-sonarqube-reproducer -Dsonar.sources=spotbugs-sonarqube-s3039-fp-substring-at-length.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube reports java:S3039 at line 3 and claims the call throws StringIndexOutOfBoundsException.

Expected behavior

SonarQube should not report this call because substring(value.length()) is valid and returns the empty string.

3

Hello @marktiwnzhao,

Thanks for your report, I’ve created this JIRA Ticket to fix the issue.