java:S6809 false-negative with @Transactional class-level annotation

Rules and Languages Report False-positive / False-negative...
,
1

The rule does not activate when one Transactional annotation is used on class level instead of individual public methods. From the functional point of view, such use of Transactional annotation is equivalent but Sonar does not report anything in this scenario.

Generally the code still may work but the rule should detect the violation of correct Spring bean coding practices anyway. Please note that adding another (unused) method with an explicit Transactional annotation to the class source code causes SonarQube for IDE to start detecting incorrectly java:S2229 instead.

package com.jpa.demo.service;

import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;

@Service
@Transactional(propagation = Propagation.REQUIRES_NEW)
public class DemoServiceImpl {
    
    public void firstTransactionalMethod() {
        
        // call another public transactional method in the wrong way
        // - this is not detected by java:S6809
        separateTransactionalMethod();
        
        // do something in my own transaction
    }

    public void separateTransactionalMethod() {
        // do something else in a separate transaction
    }

    //@Transactional(propagation = Propagation.SUPPORTS)
    //public void separateTransactionalMethod2() {
    //    // do something else
    //}
}
2

Hi,

Can you give your context for this? You’ve said SonarQube for IDE. Can you provide flavor and version?

 
Thx,
Ann

3

CONFIDENTIAL (by Asseco CE)

Hello Ann
The version of SonerQube for IDE in IntelliJ IDEA was 11.6.0.83783.
The demonstration source code provided should be sufficient to reproduce the issue by any Java programmer who can write Spring Boot code.
I know that the use case might seem to be complex, however Spring configuration is very often done using annotations, not only on methods but also on classes (and elsewhere). So, working rules for Java code using Spring need to be ready not only for the simplest use case, otherwise the programmers will not rely on them.
Best Regards
Matej Liszka

4

Hello Ann
The version of SonarQube for IDE in IntelliJ IDEA was 11.6.0.83783.
The demonstration source code provided should be sufficient to reproduce the issue by any Java programmer who can write Spring Boot code.
I know that the use case might seem to be complex, however Spring configuration is very often done using annotations, not only on methods but also on classes (and elsewhere). So, working rules for Java code using Spring need to be ready not only for the simplest use case, otherwise the programmers will not rely on them.
Best Regards
Matej Liszka

5

Hi Matej,

The current version of SonarQube for IntelliJ (formerly SonarLint) is 11.11. Can you upgrade and see if this is still replicable?

 
Thx,
Ann

6

CONFIDENTIAL (by Asseco CE)

Hello Ann
I am not a tester of SonarQube rules :slightly_smiling_face: I will come back to it maybe later on. Thank you for understanding. To be honest, I am really surprised as I expected that my input would be used by the team that maintains commercial products of Sonar. This answer is really disappointing, especially for potential customers of Sonar…
Best Regards, Matej

7

Hello Ann
I am not a tester of SonarQube rules :slightly_smiling_face: I will come back to it maybe later on. Thank you for understanding. To be honest, I am really surprised as I expected that my input would be used by the team that maintains commercial products of Sonar. This answer is really disappointing, especially for potential customers of Sonar…
Best Regards, Matej