False positive on java:S2386 when using toList()

Clean Code Report False-positive / False-negative...
1

We’ve just migrated to java 17 and are having some false positives raised with rule java:S2386 when creating constants using Stream#toList().

Before migrating, we were using the terminal operation collect(Collectors.toList()) which returned a modifiable collection and the rule rightfully ignores collections when wrapped with Collections#unmodifiableCollection/List/Set/.... Since this wrapping is useless when using toList() as the terminal operation, the rule should evolve to ignore public constants collections created with this terminal operation.

Reproducer :

public static final List<String> CONSTANT_LIST = Stream.of("").toList();

The javadoc of toList() states that the returned List is unmodifiable.

1 Like
2

Hey there.

What version(s) of what products (SonarQube, sonarLint, SonarCloud) are you using?

3

SonarQube 10.4 developer edition.
The issue is raised through SonarLint but the project is bound to SonarQube.

Edit :
Based on sonar-java:7.31.0.34839 and if I understand the code correctly, PublicStaticMutableMembersCheck#UNMODIFIABLE_METHOD_CALLS should probably be modified to add this MethodMatchers :

MethodMatchers.create()
	.ofTypes(new String[]{"java.util.stream.Stream"}).names(new String[]{"toList"})
	.build();
6

Hello @alec,

Thanks for your report. Indeed this is an old rule, that didn’t evolve after Java 16. Here is a ticket to fix it:

https://sonarsource.atlassian.net/browse/SONARJAVA-4876

Best,
Margarita

1 Like