SonarQube did not raise any warnings or code smells

narendran.a · November 17, 2025, 10:13am

We are using SonarQube Enterprise Edition for static code analysis of our Java projects and recently observed potential gap in issue detection related to resource management and exception handling are not being detected as expected.

During our review, we found that methods opening JDBC resources (such as Connection, CallableStatement, and ResultSet) without using try-with-resources or explicit close() calls SonarQube did not raise any warnings or code smells (such as rule java:S2095 or java:S3958) regarding potential resource leaks.

We would appreciate your guidance on above critical issue.

CODE:

@Override
public CoverNoteVO fnGetHonorMarketValue(CoverNoteVO coverNoteVO, ADCRequestVO adcRequestVO) {
	Connection connection = null;
	CallableStatement callableStatement = null;
	ResultSet resultSet = null;
	try {
		connection = DaoUtils.getDBConnection();
		callableStatement = connection.prepareCall("{call PKG_COMMON_UTILS.PR_GET_HONOR_MARKET_VALUE(?,?,?,?,?,?,?)}");
		callableStatement.registerOutParameter(1, OracleTypes.CURSOR);
		callableStatement.setInt(2, coverNoteVO.getPolMotorId());
		callableStatement.setInt(3, coverNoteVO.getQuotationId());
		callableStatement.setInt(4, coverNoteVO.getNvicId());
		callableStatement.setString(5, coverNoteVO.getMarketValueHonorInd() != null && !coverNoteVO.getMarketValueHonorInd().trim().isEmpty() ? coverNoteVO.getMarketValueHonorInd() : "N");
		callableStatement.setDouble(6, coverNoteVO.getMarketValue());
		
		if(adcRequestVO.getPricingDate() != null && !adcRequestVO.getPricingDate().trim().isEmpty())
            callableStatement.setDate(7, new java.sql.Date(Utilities.getDateFromString(adcRequestVO.getPricingDate().trim(), Utilities.DATEFORMAT_DDMMYYYY).getTime()));
        else if (coverNoteVO.getIssuedDate() != null)
            callableStatement.setDate(7, new java.sql.Date(coverNoteVO.getIssuedDate().getTime()));
        else
            callableStatement.setNull(7, OracleTypes.DATE);
		
		callableStatement.execute();
		resultSet = (ResultSet) callableStatement.getObject(1);

		while (resultSet.next()) {
			coverNoteVO.setMarketValue(resultSet.getDouble("NUM_HONOR_MARKET_VALUE"));
		}
	} catch (Exception e) {
		e.printStackTrace();
	}
	return coverNoteVO;
}

ganncamp · November 18, 2025, 2:11pm

Hi,

Welcome to the community and thanks for this report!

Can you share your analysis log?

The analysis / scanner log is what’s output from the analysis command. Hopefully, the log you provide - redacted as necessary - will include that command as well.

This guide will help you find them.

Thx,
Ann

narendran.a · November 19, 2025, 8:24am

Hi,

Please find scanner log below,

\[WARNING\] The artifact org.apache.commons:commons-io:jar:1.3.2 has been relocated to commons-io:commons-io:jar:1.3.2
\[INFO\]
\[INFO\] — sonar-maven-plugin:4.0.0.4121:sonar (default-cli) @ AmgServices —
\[WARNING\] 23:59:52.474 Using an unspecified version instead of an explicit plugin version may introduce breaking analysis changes at an unwanted time. It is highly recommended to use an explicit version, e.g. ‘org.sonarsource.scanner.maven:sonar-maven-plugin:4.0.0.4121’.
\[INFO\] 23:59:52.504 Java 21.0.6 Red Hat, Inc. (64-bit)
\[INFO\] 23:59:52.504 Linux 5.4.17-2136.336.5.1.el8uek.x86_64 (amd64)
\[INFO\] 23:59:52.504 MAVEN_OPTS= -Xss5m
\[INFO\] 23:59:52.928 User cache: /home/release/.sonar/cache
\[INFO\] 23:59:58.002 Communicating with SonarQube Server 2025.3.1.109879
\[INFO\] 23:59:58.026 Default locale: “en_IN”, source code encoding: “UTF-8” (analysis is platform dependent)
\[INFO\] 00:00:02.855 Load global settings
\[INFO\] 00:00:03.268 Load global settings (done) | time=414ms
\[INFO\] 00:00:03.304 Server id: 86E1FA4D-AZf0fJJqsvc3xqAdFCy5
\[INFO\] 00:00:03.417 Loading required plugins
\[INFO\] 00:00:03.417 Load plugins index
\[INFO\] 00:00:03.496 Load plugins index (done) | time=79ms
\[INFO\] 00:00:03.497 Load/download plugins
\[INFO\] 00:00:03.813 Load/download plugins (done) | time=316ms
\[INFO\] 00:00:04.153 Loaded core extensions: developer-scanner, server-common
\[INFO\] 00:00:06.528 Process project properties
\[INFO\] 00:00:06.545 Process project properties (done) | time=17ms
\[INFO\] 00:00:06.557 Project key: XXXXX_Services
\[INFO\] 00:00:06.557 Base dir: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE
\[INFO\] 00:00:06.557 Working dir: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar
\[INFO\] 00:00:06.566 Load project settings for component key: ‘XXXXX_Services’
\[INFO\] 00:00:06.596 Load project settings for component key: ‘XXXXX_Services’ (done) | time=29ms
\[INFO\] 00:00:06.625 Load project branches
\[INFO\] 00:00:06.644 Load project branches (done) | time=19ms
\[INFO\] 00:00:06.645 Load branch configuration
\[INFO\] 00:00:06.646 Load branch configuration (done) | time=1ms
\[INFO\] 00:00:06.661 Load quality profiles
\[INFO\] 00:00:06.719 Load quality profiles (done) | time=58ms
\[INFO\] 00:00:06.727 Auto-configuring with CI ‘Jenkins’
\[INFO\] 00:00:06.775 Load active rules
\[INFO\] 00:00:07.268 Load active rules (done) | time=492ms
\[INFO\] 00:00:07.274 Load analysis cache
\[INFO\] 00:00:08.003 Load analysis cache | time=729ms
\[INFO\] 00:00:08.114 Preprocessing files…
\[INFO\] 00:00:09.513 3 languages detected in 2207 preprocessed files (done) | time=1398ms
\[INFO\] 00:00:09.514 14 files ignored because of scm ignore settings
\[INFO\] 00:00:09.518 Loading plugins for detected languages
\[INFO\] 00:00:09.518 Load/download plugins
\[INFO\] 00:00:09.595 Load/download plugins (done) | time=77ms
\[INFO\] 00:00:10.047 Load project repositories
\[INFO\] 00:00:10.191 Load project repositories (done) | time=143ms
\[INFO\] 00:00:10.210 Indexing files…
\[INFO\] 00:00:10.212 Project configuration:
\[INFO\] 00:00:10.773 2207 files indexed (done) | time=560ms
\[INFO\] 00:00:10.774 Quality profile for java: KGISL_TIGHT_RULE
\[INFO\] 00:00:10.775 Quality profile for jsp: Sonar way
\[INFO\] 00:00:10.775 Quality profile for xml: Sonar way
\[INFO\] 00:00:10.775 ------------- Run sensors on module XXXXX_Services
\[INFO\] 00:00:11.025 Load metrics repository
\[INFO\] 00:00:11.055 Load metrics repository (done) | time=30ms
\[INFO\] 00:00:17.857 Sensor JavaSensor \[java\]
\[INFO\] 00:00:17.861 Configured Java source version (sonar.java.source): 8, preview features enabled (sonar.java.enablePreview): false
Nov 19, 2025 12:00:19 AM org.apache.jasper.servlet.TldScanner scanJars
INFO: At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
\[INFO\] 00:00:22.231 Server-side caching is enabled. The Java analyzer will not try to leverage data from a previous analysis.
\[INFO\] 00:00:22.234 Using ECJ batch to parse 906 Main java source files with batch size 152 KB.
\[INFO\] 00:00:24.370 Starting batch processing.
\[INFO\] 00:00:25.869 The Java analyzer cannot skip unchanged files in this context. A full analysis is performed for all files.
\[INFO\] 00:00:42.044 0% analyzed
\[WARNING\] 00:01:03.631 Invalid character encountered in file XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/src/main/java/com/amg/api/controller/MotorController.java at line 5501 for encoding UTF-8. Please fix file content or configure the encoding to be used using property ‘sonar.sourceEncoding’.
\[INFO\] 00:01:59.837 43% analyzed
\[WARNING\] 00:02:30.513 Invalid character encountered in file XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/src/main/java/com/amg/api/dao/EnquiryDAOImpl.java at line 3848 for encoding UTF-8. Please fix file content or configure the encoding to be used using property ‘sonar.sourceEncoding’.
\[INFO\] 00:03:00.296 100% analyzed
\[INFO\] 00:03:00.297 Batch processing: Done.
\[INFO\] 00:03:00.298 Did not optimize analysis for any files, performed a full analysis for all 906 files.
\[WARNING\] 00:03:00.762 Unresolved imports/types have been detected during analysis. Enable DEBUG mode to see them.
\[WARNING\] 00:03:00.763 Use of preview features have been detected during analysis. Enable DEBUG mode to see them.
\[INFO\] 00:03:00.765 No “Test” source files to scan.
\[INFO\] 00:03:00.765 Using ECJ batch to parse 1 Generated java source files with batch size 152 KB.
\[INFO\] 00:03:00.767 Starting batch processing.
\[INFO\] 00:03:00.866 100% analyzed
\[INFO\] 00:03:00.866 Batch processing: Done.
\[INFO\] 00:03:00.867 Did not optimize analysis for any files, performed a full analysis for all 1 files.
\[INFO\] 00:03:00.868 Sensor JavaSensor \[java\] (done) | time=163012ms
\[INFO\] 00:03:00.868 Sensor JaCoCo XML Report Importer \[jacoco\]
\[INFO\] 00:03:00.869 ‘sonar.coverage.jacoco.xmlReportPaths’ is not defined. Using default locations: target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml,build/reports/jacoco/test/jacocoTestReport.xml
\[INFO\] 00:03:00.870 No report imported, no coverage information will be imported by JaCoCo XML Report Importer
\[INFO\] 00:03:00.870 Sensor JaCoCo XML Report Importer \[jacoco\] (done) | time=2ms
\[INFO\] 00:03:00.870 Sensor Java Config Sensor \[iac\]
\[INFO\] 00:03:00.925 0 source files to be analyzed
\[INFO\] 00:03:00.928 0/0 source files have been analyzed
\[INFO\] 00:03:00.929 Sensor Java Config Sensor \[iac\] (done) | time=58ms
\[INFO\] 00:03:00.929 Sensor ThymeLeaf template sensor \[securityjavafrontend\]
\[INFO\] 00:03:00.937 Sensor ThymeLeaf template sensor \[securityjavafrontend\] (done) | time=7ms
\[INFO\] 00:03:00.937 Sensor SurefireSensor \[java\]
\[INFO\] 00:03:00.937 parsing \[XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/surefire-reports\]
\[INFO\] 00:03:00.938 Sensor SurefireSensor \[java\] (done) | time=1ms
\[INFO\] 00:03:00.938 Sensor HTML \[web\]
\[INFO\] 00:03:00.966 Sensor HTML \[web\] (done) | time=27ms
\[INFO\] 00:03:00.966 Sensor XML Sensor \[xml\]
\[INFO\] 00:03:00.979 4 source files to be analyzed
\[INFO\] 00:03:01.183 4/4 source files have been analyzed
\[INFO\] 00:03:01.184 Sensor XML Sensor \[xml\] (done) | time=218ms
\[INFO\] 00:03:01.184 Sensor IaC Docker Sensor \[iac\]
\[INFO\] 00:03:01.283 0 source files to be analyzed
\[INFO\] 00:03:01.283 0/0 source files have been analyzed
\[INFO\] 00:03:01.283 Sensor IaC Docker Sensor \[iac\] (done) | time=99ms
\[INFO\] 00:03:01.283 Sensor Serverless configuration file sensor \[security\]
\[INFO\] 00:03:01.286 0 Serverless function entries were found in the project
\[INFO\] 00:03:01.291 0 Serverless function handlers were kept as entrypoints
\[INFO\] 00:03:01.291 Sensor Serverless configuration file sensor \[security\] (done) | time=8ms
\[INFO\] 00:03:01.291 Sensor AWS SAM template file sensor \[security\]
\[INFO\] 00:03:01.294 Sensor AWS SAM template file sensor \[security\] (done) | time=3ms
\[INFO\] 00:03:01.294 Sensor AWS SAM Inline template file sensor \[security\]
\[INFO\] 00:03:01.296 Sensor AWS SAM Inline template file sensor \[security\] (done) | time=2ms
\[INFO\] 00:03:01.297 Sensor javabugs \[dbd\]
\[INFO\] 00:03:01.574 Reading IR files from: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar/ir/java
\[INFO\] 00:03:02.793 Analyzing 44139 functions to detect bugs.
\[INFO\] 00:03:14.409 Sensor javabugs \[dbd\] (done) | time=13112ms
\[INFO\] 00:03:14.409 Sensor pythonbugs \[dbd\]
\[INFO\] 00:03:14.410 Reading IR files from: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar/ir/python
\[INFO\] 00:03:14.410 No IR files have been included for analysis.
\[INFO\] 00:03:14.410 Sensor pythonbugs \[dbd\] (done) | time=1ms
\[INFO\] 00:03:14.410 Sensor EnterpriseTextAndSecretsSensor \[textenterprise\]
\[INFO\] 00:03:14.423 Available processors: 4
\[INFO\] 00:03:14.423 Using 4 threads for analysis.
\[INFO\] 00:03:14.488 The property “sonar.tests” is not set. To improve the analysis accuracy, we categorize a file as a test file if any of the following is true:

* The filename starts with “test”
* The filename contains “test.” or “tests.”
* Any directory in the file path is named: “doc”, “docs”, “test” or “tests”
* Any directory in the file path has a name ending in “test” or “tests”

\[INFO\] 00:03:15.059 Start fetching files for the text and secrets analysis
\[INFO\] 00:03:15.080 Using Git CLI to retrieve untracked files
\[INFO\] 00:03:15.709 Retrieving language associated files and files included via “sonar.text.inclusions” that are tracked by git
\[INFO\] 00:03:16.226 Starting the text and secrets analysis
\[INFO\] 00:03:16.231 914 source files to be analyzed for the text and secrets analysis
\[INFO\] 00:03:26.236 18/914 files analyzed, current files: src/main/java/com/amg/common/service/CommonServiceImpl.java, src/main/java/com/amg/common/dataobject/NMReportVO.java, src/main/java/com/amg/api/databjects/CoverNoteReportVO.java, …
\[INFO\] 00:03:34.450 914/914 source files have been analyzed for the text and secrets analysis
\[INFO\] 00:03:34.453 Start fetching files for the binary file analysis
\[INFO\] 00:03:34.456 There are no files to be analyzed for the binary file analysis
\[INFO\] 00:03:34.457 Sensor EnterpriseTextAndSecretsSensor \[textenterprise\] (done) | time=20047ms
\[INFO\] 00:03:34.458 Sensor JavaSecuritySensor \[security\]
\[INFO\] 00:03:34.463 Enabled taint analysis rules: S2076, S2078, S2083, S2091, S2631, S3649, S5131, S5135, S5144, S5145, S5146, S5147, S5334, S5496, S5883, S6096, S6173, S6287, S6350, S6384, S6390, S6398, S6399, S6547, S6549, S7044
\[INFO\] 00:03:34.464 Load type hierarchy and UCFGs: Starting
\[INFO\] 00:03:34.464 Load type hierarchy: Starting
\[INFO\] 00:03:34.464 Reading type hierarchy from: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar/ucfg2/java
\[INFO\] 00:03:35.059 Read 1484 type definitions
\[INFO\] 00:03:35.176 Load type hierarchy: Time spent was 00:00:00.711
\[INFO\] 00:03:35.176 Load UCFGs: Starting
\[INFO\] 00:03:35.176 Reading UCFGs from: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar/ucfg2/java
\[INFO\] 00:03:38.771 Load UCFGs: Time spent was 00:00:03.595
\[INFO\] 00:03:38.772 Load type hierarchy and UCFGs: Time spent was 00:00:04.307
\[INFO\] 00:03:38.772 Analyzing 40545 UCFGs to detect vulnerabilities.
\[INFO\] 00:03:38.772 Check cache: Starting
\[INFO\] 00:03:38.772 Load cache: Starting
\[INFO\] 00:03:38.772 Load cache: Time spent was 00:00:00.000
\[INFO\] 00:03:38.772 Check cache: Time spent was 00:00:00.000
\[INFO\] 00:03:38.772 Create runtime call graph: Starting
\[INFO\] 00:03:38.773 Variable Type Analysis #1: Starting
\[INFO\] 00:03:38.774 Create runtime type propagation graph: Starting
\[INFO\] 00:03:39.102 Create runtime type propagation graph: Time spent was 00:00:00.327
\[INFO\] 00:03:39.102 Run SCC (Tarjan) on 56237 nodes: Starting
\[INFO\] 00:03:39.192 Run SCC (Tarjan) on 56237 nodes: Time spent was 00:00:00.089
\[INFO\] 00:03:39.192 Tarjan found 56231 strongly connected components
\[INFO\] 00:03:39.192 Propagate runtime types to strongly connected components: Starting
\[INFO\] 00:03:39.299 Propagate runtime types to strongly connected components: Time spent was 00:00:00.107
\[INFO\] 00:03:39.300 Variable Type Analysis #1: Time spent was 00:00:00.526
\[INFO\] 00:03:39.303 Variable Type Analysis #2: Starting
\[INFO\] 00:03:39.303 Create runtime type propagation graph: Starting
\[INFO\] 00:03:39.717 Create runtime type propagation graph: Time spent was 00:00:00.413
\[INFO\] 00:03:39.717 Run SCC (Tarjan) on 56232 nodes: Starting
\[INFO\] 00:03:39.795 Run SCC (Tarjan) on 56232 nodes: Time spent was 00:00:00.077
\[INFO\] 00:03:39.795 Tarjan found 56226 strongly connected components
\[INFO\] 00:03:39.795 Propagate runtime types to strongly connected components: Starting
\[INFO\] 00:03:39.883 Propagate runtime types to strongly connected components: Time spent was 00:00:00.087
\[INFO\] 00:03:39.883 Variable Type Analysis #2: Time spent was 00:00:00.580
\[INFO\] 00:03:39.916 Create runtime call graph: Time spent was 00:00:01.143
\[INFO\] 00:03:39.916 Load config: Starting
\[INFO\] 00:03:41.704 Load config: Time spent was 00:00:01.788
\[INFO\] 00:03:41.704 Compute entry points: Starting
\[INFO\] 00:03:41.999 Compute entry points: Time spent was 00:00:00.294
\[INFO\] 00:03:41.999 All rules entry points : 14
\[INFO\] 00:03:41.999 Slice call graph: Starting
\[INFO\] 00:03:41.999 Retained UCFGs : 31
\[INFO\] 00:03:42.005 Slice call graph: Time spent was 00:00:00.005
\[INFO\] 00:03:42.005 Live variable analysis: Starting
\[INFO\] 00:03:42.347 Live variable analysis: Time spent was 00:00:00.341
\[INFO\] 00:03:42.347 Taint analysis for java: Starting
\[INFO\] 00:03:42.360 0 / 31 UCFGs simulated, memory usage: 449 MB
\[INFO\] 00:03:44.828 29 / 31 UCFGs simulated, memory usage: 521 MB
\[INFO\] 00:03:44.828 Taint analysis for java: Time spent was 00:00:02.480
\[INFO\] 00:03:44.828 Report issues: Starting
\[INFO\] 00:03:44.842 Report issues: Time spent was 00:00:00.013
\[INFO\] 00:03:44.852 Store cache: Starting
\[INFO\] 00:03:45.370 Store cache: Time spent was 00:00:00.517
\[INFO\] 00:03:45.372 java security sensor: Time spent was 00:00:10.911
\[INFO\] 00:03:45.373 java security sensor: Begin: 2025-11-18T18:33:34.460544136Z, End: 2025-11-18T18:33:45.372454717Z, Duration: 00:00:10.911
Load type hierarchy and UCFGs: Begin: 2025-11-18T18:33:34.464474405Z, End: 2025-11-18T18:33:38.772016753Z, Duration: 00:00:04.307
Load type hierarchy: Begin: 2025-11-18T18:33:34.464594647Z, End: 2025-11-18T18:33:35.175936452Z, Duration: 00:00:00.711
Load UCFGs: Begin: 2025-11-18T18:33:35.176434031Z, End: 2025-11-18T18:33:38.771665851Z, Duration: 00:00:03.595
Check cache: Begin: 2025-11-18T18:33:38.772161392Z, End: 2025-11-18T18:33:38.772742490Z, Duration: 00:00:00.000
Load cache: Begin: 2025-11-18T18:33:38.772212100Z, End: 2025-11-18T18:33:38.772311314Z, Duration: 00:00:00.000
Create runtime call graph: Begin: 2025-11-18T18:33:38.772914766Z, End: 2025-11-18T18:33:39.915996293Z, Duration: 00:00:01.143
Variable Type Analysis #1: Begin: 2025-11-18T18:33:38.773714983Z, End: 2025-11-18T18:33:39.300080273Z, Duration: 00:00:00.526
Create runtime type propagation graph: Begin: 2025-11-18T18:33:38.774746516Z, End: 2025-11-18T18:33:39.102009612Z, Duration: 00:00:00.327
Run SCC (Tarjan) on 56237 nodes: Begin: 2025-11-18T18:33:39.102726929Z, End: 2025-11-18T18:33:39.192331740Z, Duration: 00:00:00.089
Propagate runtime types to strongly connected components: Begin: 2025-11-18T18:33:39.192700683Z, End: 2025-11-18T18:33:39.299768278Z, Duration: 00:00:00.107
Variable Type Analysis #2: Begin: 2025-11-18T18:33:39.303250590Z, End: 2025-11-18T18:33:39.883691115Z, Duration: 00:00:00.580
Create runtime type propagation graph: Begin: 2025-11-18T18:33:39.303424898Z, End: 2025-11-18T18:33:39.717188707Z, Duration: 00:00:00.413
Run SCC (Tarjan) on 56232 nodes: Begin: 2025-11-18T18:33:39.717486623Z, End: 2025-11-18T18:33:39.795458843Z, Duration: 00:00:00.077
Propagate runtime types to strongly connected components: Begin: 2025-11-18T18:33:39.795829547Z, End: 2025-11-18T18:33:39.883388344Z, Duration: 00:00:00.087
Load config: Begin: 2025-11-18T18:33:39.916257366Z, End: 2025-11-18T18:33:41.704491213Z, Duration: 00:00:01.788
Compute entry points: Begin: 2025-11-18T18:33:41.704960294Z, End: 2025-11-18T18:33:41.999250189Z, Duration: 00:00:00.294
Slice call graph: Begin: 2025-11-18T18:33:41.999572168Z, End: 2025-11-18T18:33:42.005317406Z, Duration: 00:00:00.005
Live variable analysis: Begin: 2025-11-18T18:33:42.005479105Z, End: 2025-11-18T18:33:42.347152627Z, Duration: 00:00:00.341
Taint analysis for java: Begin: 2025-11-18T18:33:42.347684832Z, End: 2025-11-18T18:33:44.828480706Z, Duration: 00:00:02.480
Report issues: Begin: 2025-11-18T18:33:44.828671183Z, End: 2025-11-18T18:33:44.842236362Z, Duration: 00:00:00.013
Store cache: Begin: 2025-11-18T18:33:44.852697023Z, End: 2025-11-18T18:33:45.370469236Z, Duration: 00:00:00.517
\[INFO\] 00:03:45.373 java security sensor peak memory: 1583 MB
\[INFO\] 00:03:45.374 Sensor JavaSecuritySensor \[security\] (done) | time=10916ms
\[INFO\] 00:03:45.374 Sensor CSharpSecuritySensor \[security\]
\[INFO\] 00:03:45.374 Enabled taint analysis rules: S2076, S2078, S2083, S2091, S2631, S3649, S5131, S5135, S5144, S5145, S5146, S5147, S5334, S5883, S6096, S6173, S6287, S6350, S6399, S6547, S6549, S6639, S6641, S6680, S6776, S7044
\[INFO\] 00:03:45.374 Load type hierarchy and UCFGs: Starting
\[INFO\] 00:03:45.374 Load type hierarchy: Starting
\[INFO\] 00:03:45.374 Reading type hierarchy from: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/ucfg2/cs
\[INFO\] 00:03:45.374 Read 0 type definitions
\[INFO\] 00:03:45.375 Load type hierarchy: Time spent was 00:00:00.000
\[INFO\] 00:03:45.375 Load UCFGs: Starting
\[INFO\] 00:03:45.375 Load UCFGs: Time spent was 00:00:00.000
\[INFO\] 00:03:45.375 Load type hierarchy and UCFGs: Time spent was 00:00:00.000
\[INFO\] 00:03:45.375 No UCFGs have been included for analysis.
\[INFO\] 00:03:45.375 csharp security sensor: Time spent was 00:00:00.001
\[INFO\] 00:03:45.375 csharp security sensor: Begin: 2025-11-18T18:33:45.374305118Z, End: 2025-11-18T18:33:45.375465129Z, Duration: 00:00:00.001
Load type hierarchy and UCFGs: Begin: 2025-11-18T18:33:45.374659997Z, End: 2025-11-18T18:33:45.375202266Z, Duration: 00:00:00.000
Load type hierarchy: Begin: 2025-11-18T18:33:45.374701537Z, End: 2025-11-18T18:33:45.374984979Z, Duration: 00:00:00.000
Load UCFGs: Begin: 2025-11-18T18:33:45.375081167Z, End: 2025-11-18T18:33:45.375142521Z, Duration: 00:00:00.000
\[INFO\] 00:03:45.375 csharp security sensor peak memory: 1583 MB
\[INFO\] 00:03:45.375 Sensor CSharpSecuritySensor \[security\] (done) | time=1ms
\[INFO\] 00:03:45.375 Sensor PhpSecuritySensor \[security\]
\[INFO\] 00:03:45.376 Enabled taint analysis rules: S2076, S2078, S2083, S2091, S2631, S3649, S5131, S5135, S5144, S5145, S5146, S5334, S5335, S5883, S6173, S6287, S6350, S7044
\[INFO\] 00:03:45.376 Load type hierarchy and UCFGs: Starting
\[INFO\] 00:03:45.376 Load type hierarchy: Starting
\[INFO\] 00:03:45.376 Reading type hierarchy from: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar/ucfg2/php
\[INFO\] 00:03:45.376 Read 0 type definitions
\[INFO\] 00:03:45.376 Load type hierarchy: Time spent was 00:00:00.000
\[INFO\] 00:03:45.376 Load UCFGs: Starting
\[INFO\] 00:03:45.376 Load UCFGs: Time spent was 00:00:00.000
\[INFO\] 00:03:45.376 Load type hierarchy and UCFGs: Time spent was 00:00:00.000
\[INFO\] 00:03:45.376 No UCFGs have been included for analysis.
\[INFO\] 00:03:45.376 php security sensor: Time spent was 00:00:00.000
\[INFO\] 00:03:45.377 php security sensor: Begin: 2025-11-18T18:33:45.375922573Z, End: 2025-11-18T18:33:45.376776118Z, Duration: 00:00:00.000
Load type hierarchy and UCFGs: Begin: 2025-11-18T18:33:45.376190488Z, End: 2025-11-18T18:33:45.376545788Z, Duration: 00:00:00.000
Load type hierarchy: Begin: 2025-11-18T18:33:45.376230189Z, End: 2025-11-18T18:33:45.376407186Z, Duration: 00:00:00.000
Load UCFGs: Begin: 2025-11-18T18:33:45.376462132Z, End: 2025-11-18T18:33:45.376501730Z, Duration: 00:00:00.000
\[INFO\] 00:03:45.377 php security sensor peak memory: 1583 MB
\[INFO\] 00:03:45.377 Sensor PhpSecuritySensor \[security\] (done) | time=2ms
\[INFO\] 00:03:45.377 Sensor PythonSecuritySensor \[security\]
\[INFO\] 00:03:45.377 Enabled taint analysis rules: S2076, S2078, S2083, S2091, S2631, S3649, S5131, S5135, S5144, S5145, S5146, S5147, S5334, S5496, S6287, S6350, S6639, S6680, S6776, S6839, S7044
\[INFO\] 00:03:45.377 Load type hierarchy and UCFGs: Starting
\[INFO\] 00:03:45.377 Load type hierarchy: Starting
\[INFO\] 00:03:45.377 Reading type hierarchy from: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar/ucfg2/python
\[INFO\] 00:03:45.378 Read 0 type definitions
\[INFO\] 00:03:45.378 Load type hierarchy: Time spent was 00:00:00.000
\[INFO\] 00:03:45.381 Load UCFGs: Starting
\[INFO\] 00:03:45.381 Load UCFGs: Time spent was 00:00:00.000
\[INFO\] 00:03:45.381 Load type hierarchy and UCFGs: Time spent was 00:00:00.003
\[INFO\] 00:03:45.381 No UCFGs have been included for analysis.
\[INFO\] 00:03:45.382 python security sensor: Time spent was 00:00:00.004
\[INFO\] 00:03:45.382 python security sensor: Begin: 2025-11-18T18:33:45.377649478Z, End: 2025-11-18T18:33:45.382255921Z, Duration: 00:00:00.004
Load type hierarchy and UCFGs: Begin: 2025-11-18T18:33:45.377860916Z, End: 2025-11-18T18:33:45.381636005Z, Duration: 00:00:00.003
Load type hierarchy: Begin: 2025-11-18T18:33:45.377898851Z, End: 2025-11-18T18:33:45.378080131Z, Duration: 00:00:00.000
Load UCFGs: Begin: 2025-11-18T18:33:45.381080536Z, End: 2025-11-18T18:33:45.381405855Z, Duration: 00:00:00.000
\[INFO\] 00:03:45.383 python security sensor peak memory: 1583 MB
\[INFO\] 00:03:45.383 Sensor PythonSecuritySensor \[security\] (done) | time=6ms
\[INFO\] 00:03:45.383 Sensor JsSecuritySensor \[security\]
\[INFO\] 00:03:45.384 Enabled taint analysis rules: S2076, S2083, S2631, S3649, S5131, S5144, S5146, S5147, S5334, S5696, S5883, S6096, S6105, S6287, S6350
\[INFO\] 00:03:45.385 Load type hierarchy and UCFGs: Starting
\[INFO\] 00:03:45.385 Load type hierarchy: Starting
\[INFO\] 00:03:45.385 Reading type hierarchy from: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar/ucfg2/js
\[INFO\] 00:03:45.385 Read 0 type definitions
\[INFO\] 00:03:45.385 Load type hierarchy: Time spent was 00:00:00.000
\[INFO\] 00:03:45.385 Load UCFGs: Starting
\[INFO\] 00:03:45.385 Load UCFGs: Time spent was 00:00:00.000
\[INFO\] 00:03:45.385 Load type hierarchy and UCFGs: Time spent was 00:00:00.000
\[INFO\] 00:03:45.385 No UCFGs have been included for analysis.
\[INFO\] 00:03:45.386 js security sensor: Time spent was 00:00:00.002
\[INFO\] 00:03:45.386 js security sensor: Begin: 2025-11-18T18:33:45.383487360Z, End: 2025-11-18T18:33:45.386175275Z, Duration: 00:00:00.002
Load type hierarchy and UCFGs: Begin: 2025-11-18T18:33:45.385080312Z, End: 2025-11-18T18:33:45.385920009Z, Duration: 00:00:00.000
Load type hierarchy: Begin: 2025-11-18T18:33:45.385198784Z, End: 2025-11-18T18:33:45.385639917Z, Duration: 00:00:00.000
Load UCFGs: Begin: 2025-11-18T18:33:45.385786172Z, End: 2025-11-18T18:33:45.385867396Z, Duration: 00:00:00.000
\[INFO\] 00:03:45.386 js security sensor peak memory: 1583 MB
\[INFO\] 00:03:45.386 Sensor JsSecuritySensor \[security\] (done) | time=3ms
\[INFO\] 00:03:45.386 Sensor KotlinSecuritySensor \[security\]
\[INFO\] 00:03:45.386 Enabled taint analysis rules: S2076, S2078, S2083, S2091, S2631, S3649, S5131, S5135, S5144, S5145, S5146, S5147, S5334, S5496, S5883, S6096, S6173, S6287, S6350, S6384, S6390, S6398, S6399, S6547, S6549, S7044
\[INFO\] 00:03:45.386 Load type hierarchy and UCFGs: Starting
\[INFO\] 00:03:45.386 Load type hierarchy: Starting
\[INFO\] 00:03:45.387 Reading type hierarchy from: XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar/ucfg2/kotlin
\[INFO\] 00:03:45.387 Read 0 type definitions
\[INFO\] 00:03:45.387 Load type hierarchy: Time spent was 00:00:00.000
\[INFO\] 00:03:45.387 Load UCFGs: Starting
\[INFO\] 00:03:45.387 Load UCFGs: Time spent was 00:00:00.000
\[INFO\] 00:03:45.387 Load type hierarchy and UCFGs: Time spent was 00:00:00.000
\[INFO\] 00:03:45.387 No UCFGs have been included for analysis.
\[INFO\] 00:03:45.387 kotlin security sensor: Time spent was 00:00:00.000
\[INFO\] 00:03:45.387 kotlin security sensor: Begin: 2025-11-18T18:33:45.386643432Z, End: 2025-11-18T18:33:45.387493837Z, Duration: 00:00:00.000
Load type hierarchy and UCFGs: Begin: 2025-11-18T18:33:45.386889705Z, End: 2025-11-18T18:33:45.387265540Z, Duration: 00:00:00.000
Load type hierarchy: Begin: 2025-11-18T18:33:45.386935109Z, End: 2025-11-18T18:33:45.387115322Z, Duration: 00:00:00.000
Load UCFGs: Begin: 2025-11-18T18:33:45.387171907Z, End: 2025-11-18T18:33:45.387218956Z, Duration: 00:00:00.000
\[INFO\] 00:03:45.387 kotlin security sensor peak memory: 1583 MB
\[INFO\] 00:03:45.387 Sensor KotlinSecuritySensor \[security\] (done) | time=1ms
\[INFO\] 00:03:45.387 Sensor GoSecuritySensor \[security\]
\[INFO\] 00:03:45.387 No taint analysis rules have been enabled, will not execute taint analysis.
\[INFO\] 00:03:45.388 go security sensor: Time spent was 00:00:00.000
\[INFO\] 00:03:45.388 go security sensor: Begin: 2025-11-18T18:33:45.387949798Z, End: 2025-11-18T18:33:45.388152892Z, Duration: 00:00:00.000
\[INFO\] 00:03:45.388 go security sensor peak memory: 1583 MB
\[INFO\] 00:03:45.388 Sensor GoSecuritySensor \[security\] (done) | time=1ms
\[INFO\] 00:03:45.393 ------------- Run sensors on project
\[INFO\] 00:03:45.651 Sensor JavaArchitectureSensor \[architecture\]
\[INFO\] 00:03:45.685 \* Protobuf reading starting | memory total=1074 | free=485 | used=588 (MB)
\[INFO\] 00:03:45.686 \* Reading SonarArchitecture IR data from directory “XXXXXXXXXX/SONARQUBE/XXXXX_SERVICE/target/sonar/architecture/java”
\[INFO\] 00:03:47.055 \* Files successfully loaded: “904” out of “904”
\[INFO\] 00:03:47.055 \* Protobuf reading complete | memory total=1074 | free=86 | used=987 (MB)
\[INFO\] 00:03:47.520 \* Excluding node by kind: com.amg.common.utility.Column \[annotation\]
\[INFO\] 00:03:47.576 \* Excluding node by kind: com.amg.common.utility.OneToMany \[annotation\]
\[INFO\] 00:03:47.988 \* Build file hiGraphs complete | memory total=1098 | free=413 | used=684 (MB)
\[INFO\] 00:03:48.328 \* Slicing complete | memory total=1098 | free=401 | used=696 (MB)
\[INFO\] 00:03:48.350 \* Cycle detection complete | memory total=1098 | free=401 | used=696 (MB)
\[INFO\] 00:03:49.088 \* Build file hiGraphs complete | memory total=1098 | free=195 | used=902 (MB)
\[INFO\] 00:03:49.533 \* Build container hiGraphs complete | memory total=1282 | free=635 | used=646 (MB)
\[INFO\] 00:03:49.533 \* Export complete | memory total=1282 | free=635 | used=646 (MB)
\[INFO\] 00:03:49.533 Sensor JavaArchitectureSensor \[architecture\] (done) | time=3882ms
\[INFO\] 00:03:49.537 Sensor Zero Coverage Sensor
\[INFO\] 00:03:49.845 Sensor Zero Coverage Sensor (done) | time=308ms
\[INFO\] 00:03:49.846 Sensor Java CPD Block Indexer
\[INFO\] 00:03:53.296 Sensor Java CPD Block Indexer (done) | time=3450ms
\[INFO\] 00:03:53.297 ------------- Gather SCA dependencies on project
\[INFO\] 00:03:53.381 Dependency analysis skipped
\[INFO\] 00:03:53.505 SCM Publisher SCM provider for this project is: git
\[INFO\] 00:03:53.507 SCM Publisher 1 source file to be analyzed
\[INFO\] 00:03:54.636 SCM Publisher 0/1 source files have been analyzed (done) | time=1095ms
\[WARNING\] 00:03:54.637 Missing blame information for the following files:
\[WARNING\] 00:03:54.637   \* src/main/java/com/amg/api/controller/MotorController.java
\[WARNING\] 00:03:54.637 This may lead to missing/broken features in SonarQube
\[INFO\] 00:03:54.931 CPD Executor 132 files had no CPD blocks
\[INFO\] 00:03:54.931 CPD Executor Calculating CPD for 775 files
\[WARNING\] 00:03:55.044 Too many duplication groups on file src/main/java/com/amg/common/dao/CommonDAOImpl.java. Keep only the first 100 groups.
\[WARNING\] 00:03:55.176 Too many duplication groups on file src/main/java/com/amg/product/dataobject/CoverNoteDO.java. Keep only the first 100 groups.
\[WARNING\] 00:03:55.408 Too many duplication groups on file src/main/java/com/amg/api/dao/CoverNoteDaoImpl.java. Keep only the first 100 groups.
\[WARNING\] 00:03:55.459 Too many duplication groups on file src/main/java/com/amg/api/dao/EnquiryDAOImpl.java. Keep only the first 100 groups.
\[WARNING\] 00:03:55.501 Too many duplication groups on file src/main/java/com/amg/api/databjects/CoverNoteVO.java. Keep only the first 100 groups.
\[WARNING\] 00:03:55.533 Too many duplication groups on file src/main/java/com/amg/product/dataobject/CoverNoteVO.java. Keep only the first 100 groups.
\[WARNING\] 00:03:55.585 Too many duplication groups on file src/main/java/com/amg/common/controller/DownloadFileController.java. Keep only the first 100 groups.
\[INFO\] 00:03:55.586 CPD Executor CPD calculation finished (done) | time=655ms
\[INFO\] 00:03:55.591 SCM revision ID ‘24baad183d951c21aeb6a2a36f7a28995d31e6b4’
\[INFO\] 00:03:56.187 Load New Code definition
\[INFO\] 00:03:56.253 Load New Code definition (done) | time=66ms
\[INFO\] 00:03:56.325 Analysis report generated in 668ms, dir size=56.4 MB
\[INFO\] 00:03:59.743 Analysis report compressed in 3417ms, zip size=18.7 MB
\[INFO\] 00:04:00.759 Analysis report uploaded in 1015ms
\[INFO\] 00:04:00.774 ANALYSIS SUCCESSFUL, you can find the results at: https://XXXXX/dashboard?id=XXXXX_Services
\[INFO\] 00:04:00.774 Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
\[INFO\] 00:04:00.774 More about the report processing at https://XXXXX/api/ce/task?id=3af7c4c5-e525-4be9-ad39-f4c4efab1d26
\[INFO\] 00:04:01.059 Analysis total time: 3:56.906 s
\[INFO\] ------------------------------------------------------------------------
\[INFO\] BUILD SUCCESS
\[INFO\] ------------------------------------------------------------------------
\[INFO\] Total time: 04:20 min
\[INFO\] Finished at: 2025-11-19T00:04:01+05:30
\[INFO\] Final Memory: 147M/500M
\[INFO\] ------------------------------------------------------------------------

ganncamp · November 19, 2025, 1:17pm

Hi,

Thanks for the log. It tells the story:

You’ve told the scanner to analyze your code as being written to Java 8. Java 8 didn’t have try-with-resources, so you’re not going to be dinged for not using it.

You’re analyzing with Maven so this may be being picked up automatically from your pom, or you might be setting it explicitly with a sonar.java.source property.

HTH,
Ann

narendran.a · November 21, 2025, 7:12am

Hi,

The try-with-resources statement, introduced in Java 7 (JSR 201), has been the recommended best practice for resource management ever since, and it is fully supported in Java 8.

If the analysis is indeed being executed using Java 8, SonarQube is expected to identify cases where traditional try–finally blocks are used instead of the safer try-with-resources construct. In such scenarios, potential resource-handling violations should normally be reported.

Thanks…
Naren

ganncamp · November 21, 2025, 12:24pm

Hi Naren,

Wow! I knew I should have looked that up rather than relying on my memory.

Sorry about that. I’ll flag this for the language experts.

Ann

tomasz.tylenda · December 3, 2025, 1:58pm

Hi Naren,

I experimented with the example that you provided and discovered that the S2095 (Use try-with-resources) rule will be triggered for connection if it’s created directly via a standard method like DriverManager.getConnection.

However, the rule is not triggered when the connection comes from a custom or third-party library, such as DaoUtils.

This behavior appears to be an intentional trade-off. The analyzer is designed to stop its deep analysis at class boundaries, as we cannot reliably know if an external method like DaoUtils.getConnection() already handles the resource lifecycle (i.e., whether it calls close() internally).

Regarding the callableStatement, it should also raise S2095 if you create it using a connection that was retrieved without the DaoUtils proxy.

While we don’t have a quick fix immediately, I filed a ticket to capture what we learned from your example and track this behavior: JAVASE-152.

Topic		Replies	Views
SonarQube depends on method name and behaviors differently during analysis java “try with resources” SonarQube Server / Community Build java , sonarqube , scanner	0	383	October 28, 2020
Try-with-resources should be used - Rule ID:java:S2093 - Potential False Negative - Java Report False-positive / False-negative... java , sonarqube , java21	3	178	October 8, 2024
Seeing "No code files were found for analysis" SonarQube Server / Community Build java , sonarqube , scanner	1	2266	November 10, 2022
Modify existing Java rules Plugin Development java , sonarqube	5	936	July 14, 2020
Issues not failing build 7.5 SonarQube SonarQube Server / Community Build	24	6173	January 21, 2019

SonarQube did not raise any warnings or code smells

Related topics