FP on java S5164: ThreadLocal#remove not detected when JsonNode is type of ThreadLocal

Clean Code Report False-positive / False-negative...
,
1

Make sure to read this post before raising a thread here:

Then tell us:

  • S5164
  • SonarQube - Community Edition Version 8.9.7 (build 52159)
class FpS5164
{
  private static final ThreadLocal<JsonNode> TL = new ThreadLocal<>();

  void clean()
  {
    TL.remove();
  }
}

The false positive disappears by changing ThreadLocal type from JsonNode to String.

com.fasterxml.jackson.databind.JsonNode

2

Hi,

Welcome to the community and thanks for this report!

The current LTS is 9.9. Could you upgrade and see if this is replicable?

 
Thx,
Ann

3

Hi,

We currently have no way to upgrade the version to LTS 9.9.
Are there any other options to check this case for an issue?

Thanks,
Alex

4

Hi Alex,

If you’re on the latest version of SonarLint and not in connected mode, you’ll run the most up-to-date implementation of the rule. So that would be another way to check. And you probably wanted SonarLint in your IDE anyway, didn’t you? :wink:

 
Ann

5

Hi Ann,

Thanks for the quick response.
I have ran the analyze in the latest version of SonarLint and the issue was not detected.
Does this mean that rule S5164 has incorrect behavior for this case in SonarQube version 8.9.7?

Thanks,
Alex

6

Hi Alex,

Yes, that’s what it means. And once you upgrade, you’ll get the correct behavior.

 
Ann