S9024 should not be activated by default

SonarQube Cloud
1

Rule S9024 has been activated a few days ago in the built-in sonar way profile on our sonarqube cloud US server.

I believe this rule is detrimental, and should either be removed or at the very least be deactivated by default (and users can enable it should they wish to do so).

Using Mockito’s @InjectMocks is widely considered a bad practice because it fails silently when it cannot inject dependencies, relies on fragile reflection tricks, and masks poor architectural design.
When using constructor injection (which is a best practice), if the constructor is modified, you will get no compilation error in the test (which helps understand which tests should be adjusted following the modification.)

It “encourages” developers/agents to use field injection - which I believe Sonar itself flags as an issue.

Environment:

  • ALM: Github
  • CI: GH Actions
  • Languages of the repository: java
  • SonarQube Cloud US
3

Hi @Yaniv_Nahoum,

Thank you for taking the time to share your feedback with us.

You make a valid point. While the rule was originally intended to reduce boilerplate code in mockito tests, flagging constructor-based injection directly conflicts with rule S6813 (which discourages field injection and promotes constructor injection as a best practice).

We agree that S9024 shouldn’t be part of our default ruleset. We have deactivated it from the Sonar Way profile, and this change will roll out with our next release.

Best,

Noémie

5

Thank you! :folded_hands:t3: :folded_hands:t3::folded_hands:t3: