java:S6857 false positive when supplying a JNDI environment var

[sanderv (Sander Verbruggen)]

Make sure to read this post before raising a thread here:

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Then tell us:

• What language is this for? Java
• Which rule? java:S6857 - SpEL expression should have a valid syntax
• Why do you believe it’s a false-positive/false-negative? The code has been working in production for >5 years
• Are you using
  • SonarCloud? yes
• How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)

The ‘offensive’ line is

@PropertySource(value = "file:${osgp/Global/config}", ignoreResourceNotFound = true)

I assume the slashes are the problem. However, the 'environment var osgp/Global/config is a valid in a JNDI environment. In this case:

  <Environment name="osgp/Global/config" value="/etc/osgp/global.properties"
    type="java.lang.String" override="true" />

taken from the context.xml used by e.g. Tomcat. The full (and valid) JNDI url would be java:comp/env/osgp/Global/config.

This is in our open source project, here is the public link to SonarCloud: SonarCloud

[irina.batinic]

Hi @sanderv,

Thank you for reporting!
This is indeed an FP. Here is a ticket to track the progress for fixing it: SONARJAVA-5079.

All the best,

Irina

[internetstaff (cott)]

This also happens with ${random....}