Java Rule S1943 should take into account if a FileWriter or FileReader is created with a charset

[tschindler (Thomas Schindler)]

I’m using a FileWriter in order to write some analysis information of my application in a text file. The rule S1943 raises an issue even if the FileWriter is created with a CharSet - value like this:

BufferedWriter bw = new BufferedWriter(new FileWriter(resourcedFile, StandardCharsets.UTF_8));

Results in the following Sonar Issue:

I assume, that this rule doesn’t take into account the new FileWriter and FileReader constructors with the charset argument.

We are using SonarQube Version 7.5.0.20543 with SonarJava 5.11 (build 17289).

[Michael (Michael Gumowski)]

Hey Thomas,

Thanks for the feedback! I realized with this that the rule squid:S1943 has yet to be updated to cover methods which would have been introduced with Java 11. I created the following ticket to fix it: SONARJAVA-3057

Cheers,
Michael

[Adam_Lu]

I encountered the same issue as described here. We want to enforce this rule for our codebase but we want to keep some usages of FileReader and FileWriter that are created with Charset. I don’t see the rule has been changed yet. Will there be a change anytime soon? Thanks.

[tschindler (Thomas Schindler)]

Hi,

according to the ticket SONARJAVA-3057, this should be fixed in Version 5.12, but I checked it now in our codebase and actually there is still an Issue raised, when using the FileWriter constructor with an encoding set. We are using version 6.3.2.22818 of the java plugin.

I didn’t noticed before, as our developers marked the code with //NOSONAR.

Best Regards,
Thomas

[Quentin (Quentin Jaquier)]

Hello @tschindler and @Adam_Lu

I had a look at this problem, and it is true that this rule still reports false positives when using FileWriter or FileReader in some context. Ticket created: SONARJAVA-3772.

However, the case initially reported works fine on my side.
If the examples described in the ticket do not match the false positives you are facing, could you provide us a code sample raising the issue? Providing the exact issue message would help as well.

Thanks

[tschindler (Thomas Schindler)]

Hello @Quentin

I checked this with the following code:

1  package de.empic.web.core;
2  
3  import java.io.File;
4  import java.io.FileWriter;
5  import java.io.IOException;
6  import java.io.Writer;
7  import java.nio.charset.StandardCharsets;
8  
9  public class S1943Example
10 {
11    Writer foo(File file) throws IOException
12    {
13      FileWriter statusFileWriter = new FileWriter(new File("c:\temp", "status.txt"), 
14 StandardCharsets.UTF_8); // This produces a FP for S1943
15 
16      return new FileWriter(file, StandardCharsets.UTF_8); // This does not produce a FP for S1943
17 
18   }
19 }

With the in Line 16, there is no FP produces anymor, but in line 13, a FP is produced as you can see in the followin screenshot:

The issue message is

Remove this use of “java.io.FileWriter”

Versions used

SonarQube: 8.7.0.41497
SonarLint: 4.14.2.28348
Intellij IDEA: 2020.3.3
Java: 11.0.5

[Quentin (Quentin Jaquier)]

Perfect, I confirm that the issue you are facing is related to the problem described in the ticket above. I added your example to the description to make sure we are correctly supporting it.

Thank you very much @tschindler for coming back to us with a clear description of the issue.

Best,
Quentin