False positive on java:S2386 when using toList()

We’ve just migrated to java 17 and are having some false positives raised with rule java:S2386 when creating constants using Stream#toList().

Before migrating, we were using the terminal operation collect(Collectors.toList()) which returned a modifiable collection and the rule rightfully ignores collections when wrapped with Collections#unmodifiableCollection/List/Set/.... Since this wrapping is useless when using toList() as the terminal operation, the rule should evolve to ignore public constants collections created with this terminal operation.

Reproducer :

public static final List<String> CONSTANT_LIST = Stream.of("").toList();

The javadoc of toList() states that the returned List is unmodifiable.

1 Like

Hey there.

What version(s) of what products (SonarQube, sonarLint, SonarCloud) are you using?

SonarQube 10.4 developer edition.
The issue is raised through SonarLint but the project is bound to SonarQube.

Edit :
Based on sonar-java: and if I understand the code correctly, PublicStaticMutableMembersCheck#UNMODIFIABLE_METHOD_CALLS should probably be modified to add this MethodMatchers :

	.ofTypes(new String[]{"java.util.stream.Stream"}).names(new String[]{"toList"})

Hello @alec,

Thanks for your report. Indeed this is an old rule, that didn’t evolve after Java 16. Here is a ticket to fix it:



1 Like