# FP java:S6856 when using Spring property injection "${...}"

**URL:** <https://community.sonarsource.com/t/fp-java-s6856-when-using-spring-property-injection/138837>\
**Category:** Report False-positive / False-negative...\
**Tags:** false-positive, rules, java\
**Created:** [April 15, 2025, 4:47pm UTC](https://community.sonarsource.com/t/fp-java-s6856-when-using-spring-property-injection/138837 "2025-04-15T16:47:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mfillon](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/mfillon/32/68639_2.png) [@mfillon](https://community.sonarsource.com/u/mfillon)\
**Post date:** [April 15, 2025, 4:47pm UTC](https://community.sonarsource.com/t/fp-java-s6856-when-using-spring-property-injection/138837/1 "2025-04-15T16:47:55Z")

</div>

- _What language is this for?_

Java /Spring

- _Which rule?_

Rule [java:S6856](https://rules.sonarsource.com/java/RSPEC-6856) `@PathVariable` annotation should be present if a path variable is used

- Why do you believe it’s a false-positive?

Using Spring property injection in controller path should be allowed and should not be considered as path variable which syntax is `".../{myPathVar}/..."` instead if `"${my.spring.property.key}/..."`

- _Are you using_
  - _SonarQube for IDE - which IDE/version?_

IntelliJ Ultimate (v2024.3.5) - plugin v10.20.0.80985

- _How can we reproduce the problem? Give us a self-contained snippet of code_

Consider a basic Spring app with properties configured and injected in Controller path.

- `src/main/resources/application.yml` file:

```yml
myapp:
  api:
    version1: "api/v1"
    version2: "api/v2"

```

- `src/main/java/com/myapp/MyController.java`

```java
//imports

@RestController
public class MyController {
    //... constructor/services injection

    @GetMapping("/${myapp.api.version1}/languages")
    public List<Language> getAllLanguagesV1() {
        return serviceV1.getAllLanguages();
    }

    @GetMapping("/${myapp.api.version2}/languages")
    public List<Language> getAllLanguagesV2() {
        return serviceV2.getAllLanguages();
    }
}

```

In this case Sonar is reporting the issue for both methods when it shouldn’t.

We could argue that injecting spring property in path is not “clean” and the code could be refactored to inject Spring properties differently but that would be another rule then.

---

<div class="post-metadata">

**Author:** ![Leonardo\_Pilastri](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/leonardo_pilastri/32/38853_2.png) [@Leonardo\_Pilastri](https://community.sonarsource.com/u/Leonardo_Pilastri)\
**Post date:** [April 17, 2025, 8:57am UTC](https://community.sonarsource.com/t/fp-java-s6856-when-using-spring-property-injection/138837/4 "2025-04-17T08:57:01Z")

</div>

Hi there,

indeed this should not be reported by this rule, I created [a ticket](https://sonarsource.atlassian.net/browse/SONARJAVA-5496) to fix the problem.

Thanks a lot for the thorough report!!

---

<div class="post-metadata">

**Author:** ![erwan.serandour](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/erwan.serandour/32/48660_2.png) [@erwan.serandour](https://community.sonarsource.com/u/erwan.serandour)\
**Post date:** [May 13, 2025, 2:56pm UTC](https://community.sonarsource.com/t/fp-java-s6856-when-using-spring-property-injection/138837/8 "2025-05-13T14:56:06Z")

</div>

Hello, The ticket is done and the fix will be available on SonarQube Cloud soon, and included with the release of SonarQube Server 2025 Release 3.