the variable doc is reassigned at line 37 and 39 but claimed to stay null
and of course at runtime testing the doc normally returns the proper value
Hey there.
I’ve moved your post to the section on reporting false-positives.
Can you please update your post with the information requested in this post, specifically a text-based code sample (or link to a public SonarCloud project) rather than a screenshot?
thx, sure i ccheck on it
String doc = null;
if (file.isPresent()) {
Object element = file.get().getElement(offset);
if (element instanceof IContentTag ct) {
doc = getForTag(ct);
} else if (element instanceof IContentAttribute ca) {
doc = getForAttribute(processor, offset, ca);
}
}
return doc != null ? doc : NO_DOC_AVAILABLE;
Hello @Henning_Luther, thanks for reaching out.
I failed to reproduce the issue with the following code:
String sample(boolean a, boolean b, boolean c) {
String doc = null;
if (a) {
if (b) {
doc = "B";
} else if (c) {
doc = "C";
}
}
return doc != null ? doc : "NO_DOC_AVAILABLE";
}
Can you provide a reproducible example? Also, what is the rule that raises the issue? Is it part of Sonar way Quality Profile?
it is that one: SonarCloud
so my guess would be that the both methods called are claimed to return null. they can but normally dont.
@SuppressWarnings("deprecation")//commons-text not avail in eclipse plugin repo
private static String getForTag(IContentTag ct) {
if (ct.getCastTag() != null) {
return DocumentationHelper.getTagDocumentation(ct.getCastTag());
} else if (ct.getValidationException() != null) {
return StringEscapeUtils.escapeHtml4(ct.getValidationException().getMessage());
}
return null;
}
private static String getForAttribute(IProjectProcessor processor, int offset,
IContentAttribute att) {
IRange valueNode = att.getValueRange();
IContentTag tag = att.getParent();
if (tag.getCastTag() != null) {
Optional<ICastAttribute> castAttributeOpt = tag.getCastTag().getAttribute(att.getName());
if (castAttributeOpt.isPresent()) {
ICastAttribute castAttribute = castAttributeOpt.get();
if (valueNode != null && valueNode.contains(offset)) {
return DocumentationHelper.getAttributeValueDocumentation(processor, castAttribute,
att.getValue());
} else {
return DocumentationHelper.getAttributeDocumentation(processor, castAttribute);
}
}
}
return null;
}
@angelo.buono got it 
public static void main(String[] args) {
for(int i = 0;i<100;i++) {
System.out.println(testSonarBug());
}
}
public static Object testSonarBug() {
Object o = null;
if(testSonarBug1()) {
o = 3;
}else if(testSonarBug2()){
o = 4;
}
return o!=null? o : 8;
}
public static boolean testSonarBug1() {
Object o = null;
if(testSonarBug3().isPresent()) {
o = 1;
}else {
o = null;
}
return o == null;
}
public static boolean testSonarBug2() {
if(testSonarBug3().isPresent()) {
LOGGER.debug(TESTAUTOMAT_ERROR);
}else {
return true;
}
return false;
}
public static Optional<Object> testSonarBug3() {
return RANDOM.nextBoolean()?Optional.empty():Optional.of(new Object());
}
output:
4
4
4
8
3
4
8
4
3
3
4
3
3
4
3
3
3
3
Hello @Henning_Luther, I tried to reproduce it using your code without any success. I tried with:
-
Sonar Cloud
-
Sonar Qube Community Edition v 10.1.1
-
Sonar Qube Enterprise Edition v10.2.1
I double-checked that the quality profile includes rule S2583. Are you aware of any custom configuration you are using?
In general, this rule is very noisy since it relies on the Symbolic Execution engine that is not maintained. There are many false positives reported, but none seems to match your scenario.
we dont have any special custom config. we just use what sonar is offering. so would you recommend to disable those rules?
i also observe similar problem whith java:S3516 : SonarCloud
The rules with the “symbolic-execution” tag are definitely noisy, so affected by many false positives, and the engine is not maintained at the moment.
I will recommend you to still report these scenarios, so we can try to reproduce them and, once verified, open an issue. Meanwhile, you can disable those rules.
A new engine, the “Data Bug Detection”, is available for Sonar Qube Enterprise and Sonar Cloud for dealing with rules that require data flow tracking. The “symbolic-execution” rules are being migrated there.
For example, S2583 will be available soon. I’ll suggest keeping an open eye and enabling the new versions of these rules once they are available; most likely they will be automatically enabled in the Sonar way quality profile on Sonar Cloud.
1 Like