java:S4605: Class is not reachable by @ComponentScan or @SpringBootApplication

Rules and Languages Report False-positive / False-negative...
,
1

java:S4605

I’m using SonarQube server 9.9 running SonarJava 7.16 and I’m getting the following issue on a Spring’s @Service annotated class:

‘MyClass’ is not reachable by @ComponentScan or @SpringBootApplication. Either move it to a package configured in @ComponentScan or update your @ComponentScan configuration.

I believe it’s a false positive because the beans are actually accessible in the application context of the service accessing this class.

This is the @AutoConfiguration class:

package com.org.myapp.config;

@AutoConfiguration
@ComponentScan(
    basePackageClasses = BaseScanningPackage.class,
    excludeFilters = {
        @ComponentScan.Filter(type = FilterType.ANNOTATION, classes = Configuration.class),
    })
public class MyAppAutoConfig
{
}

And this is BaseScanningPackage:

package com.org.myapp;

public interface BaseScanningPackage
{
}
2

Hey there!

Can you detail how you execute your scan? Do you use the SonarScanner CLI or something specific to your build system, like the Scanner for Maven or Gradle?

3

Using the scanner for gradle

4

Thanks. There’s a known FP when semantic data isn’t complete (SONARJAVA-4601), but this shouldn’t be the case if you’re using the Scanner for Gradle. I’ll flag this for attention.

8

Hello @davoaux,

Thanks for reaching out and reporting the issue. Indeed the rule is quite old and does not take into consideration basePackageClasses.

I create a ticket for it:

https://sonarsource.atlassian.net/browse/SONARJAVA-4967

Best,
Margarita