Skip to content

Releases: SonarSource/sonar-java

6.11.0.24617

13 Jan 06:44
@dorian-burihabwa-sonarsource dorian-burihabwa-sonarsource
6.11.0.24617
dea0726
Compare
Choose a tag to compare
6.11.0.24617 
    Release Notes - SonarJava - Version 6.11.0.24617

Bug

  • [SONARJAVA-3609] - JAR files passed to sonar.java.libraries remain locked after the analysis on Windows
  • [SONARJAVA-3652] - SuppressWarnings Filter lose knowledge of filtered lines

New Feature

  • [SONARJAVA-3614] - Rule S6073: Mockito argument matchers should be used on all parameters
  • [SONARJAVA-3630] - Rule S6103: AssertJ assertions with "Consumer" arguments should contain assertion inside consumers
  • [SONARJAVA-3632] - Rule S6104: Map "computeIfAbsent()" should not be used to add "null" values.
  • [SONARJAVA-3637] - Introduce "sonar.java.jdkHome" to specify the JDK to be used by the analyzer to resolve JDK types

Task

Improvement

False-Positive

  • [SONARJAVA-3467] - FP on S1948 when using both field and setter/constructor injection
  • [SONARJAVA-3574] - S2755 FP when Factory is declared with lombok "val"
  • [SONARJAVA-3578] - FP in S2147 when the type of the Exception is needed inside the body.
  • [SONARJAVA-3620] - FP in S2384 when unmodifiable collection is returned from a non-final field
  • [SONARJAVA-3628] - FP in S5853 when assertions "flatExtracting" prevent the chaining
  • [SONARJAVA-3633] - FP in S4032 when there are several source directories
  • [SONARJAVA-3642] - FP in S1874 when parent constructor is deprecated but not used
  • [SONARJAVA-3647] - FP in S1481 when "for-each" variable nested in a lambda is actually used in the body
  • [SONARJAVA-3650] - FP in S2970 for nested class using JUnit 5 Soft assertions extension.

False Negative

  • [SONARJAVA-3555] - S4830 should support X509ExtendedTrustManager
  • [SONARJAVA-3575] - FN in S2095: support Apache commons IOUtils methods not closing the stream
  • [SONARJAVA-3626] - FN Rule S3824: Apply the same SymbolicValue for static constants or enum constants when used as MemberSelect
Loading

6.10.0.24201

07 Dec 21:45
@sebastian-hungerecker-sonarsource sebastian-hungerecker-sonarsource
6.10.0.24201
5b61d27
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
6.10.0.24201 
    Release Notes - SonarJava - Version 6.10.0.24201

Bug

  • [SONARJAVA-3056] - Classes for the analysis are loaded with parent first strategy
  • [SONARJAVA-3602] - JavaCheckVerifier does not support consistent behavior when having multiple issues reported on the same line

New Feature

  • [SONARJAVA-3550] - Rule S5994: Regex patterns following a possessive quantifier should not always fail
  • [SONARJAVA-3552] - Rule S5996: Regex boundaries should not be used in a way that can never match
  • [SONARJAVA-3554] - Rule S5998: Regular expressions should not overflow the stack
  • [SONARJAVA-3557] - Rule S6001: Back references in regular expressions should only refer to capturing groups that are matched before the reference
  • [SONARJAVA-3560] - Rule S6002: Regex lookahead assertions should not be contradictory
  • [SONARJAVA-3566] - Rule S5855: Regex alternatives should not be redundant
  • [SONARJAVA-3567] - Rule S6019: Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string
  • [SONARJAVA-3572] - Rule S6035: Single-character alternations in regular expressions should be replaced with character classes
  • [SONARJAVA-3608] - Rule S6068: Call to Mockito method "verify", "when" or "given" should be simplified
  • [SONARJAVA-3610] - Rule S6070: The regex escape sequence \cX should only be used with characters in the @-_ range

Task

Improvement

False-Positive

  • [SONARJAVA-3470] - Add more exceptions to S107
  • [SONARJAVA-3545] - Rule S4973 shouldn't report an issue if "==" is used to compare Boolean constants
  • [SONARJAVA-3565] - FP on S1948 when using SpringBean from Apache Wicket
  • [SONARJAVA-3571] - FP on S1948 when collection implements Serializable
  • [SONARJAVA-3577] - FP in S3457 when slf4j log arguments contains a concatenation and a single Throwable
  • [SONARJAVA-3579] - FP in S1170 when class is annotated with @lombok.Builder and field with @default
  • [SONARJAVA-3580] - FP in S2390: do not report an issue on static class nested in the parent.
  • [SONARJAVA-3586] - Support Nullable annotation from reactor-core
  • [SONARJAVA-3598] - FP in S2973 when symbol is in lowercase
  • [SONARJAVA-3599] - FP in S2226 for non final Servlet fields initialized in init() method without parameters
  • [SONARJAVA-3605] - FP in S3305 when field has an initializer
  • [SONARJAVA-3612] - FP in S1185 when class is annotated "@transactional"
  • [SONARJAVA-3613] - FP in S1193 when the catch block contains more code
  • [SONARJAVA-3615] - FP in S1905 when casted argument is a method reference to a varargs.
  • [SONARJAVA-3617] - S1170 should not raise an issue when the initializer contains "this" or "super"
  • [SONARJAVA-3618] - FP on S3438 when "value" is set inside the property tag
  • [SONARJAVA-3619] - FP S2589 when Boolean variable doesn't always evaluate to TRUE/FALSE
  • [SONARJAVA-3621] - Union of Unknown types should be Unknown

False Negative

  • [SONARJAVA-3130] - S3824: raise issue when "containsKey" is used
  • [SONARJAVA-3482] - Support character classes as operand to reluctant quantifier in rule S5857
  • [SONARJAVA-3483] - FN in S5869 with escaped character classes
Loading

6.9.0.23563

05 Oct 08:31
6.9.0.23563
970d69b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
6.9.0.23563 
    Release Notes - SonarJava - Version 6.9.0.23563

Bug

  • [SONARJAVA-3285] - Java 13/14 preview feature "Text Block" produce highlighting IllegalArgumentException
  • [SONARJAVA-3541] - NPE in Symbolic Execution engine when dealing with java 14 switch expressions without default

New Feature

  • [SONARJAVA-3374] - Rule S5804 allowing user enumeration is security-sensitive
  • [SONARJAVA-3396] - Rule S5808 Authorizations should be based on strong decisions
  • [SONARJAVA-3411] - Rule S5876 A new session should be created during user authentication
  • [SONARJAVA-3542] - RSPEC-5993 Constructors of an "abstract" class should not be declared "public"

Task

Improvement

  • [SONARJAVA-3376] - Rule S3752: from Vulnerability to Security Hotspot and small improvements on the detection algorithm
  • [SONARJAVA-3414] - Rule S4790: its content should be replaced by S2070
  • [SONARJAVA-3472] - Document wildcards pattern in rule's parameters (S110, S1176)
  • [SONARJAVA-3478] - S2201: Support common Collection and Map methods
  • [SONARJAVA-3525] - S2333 supports redundant modifiers on nested interfaces and classes
  • [SONARJAVA-3536] - Consistently support Nullable/CheckForNull/Nonnull annotations in rules
  • [SONARJAVA-3539] - FP in S5845 when BigDecimal and BigInteger are compared with string

False-Positive

False Negative

  • [SONARJAVA-3388] - Rule S2070 should support "org.springframework.util.DigestUtils"
  • [SONARJAVA-3538] - S5853 does not handle custom assertions
Loading

6.8.0.23379

23 Sep 13:50
@margarita-nedzelska-sonarsource margarita-nedzelska-sonarsource
6.8.0.23379
1eb56f1
Compare
Choose a tag to compare
6.8.0.23379 
    Release Notes - SonarJava - Version 6.8

New Feature

  • [SONARJAVA-3372] - Rule S5803: Class members annotated with @VisibleForTesting should not be accessed from production code
  • [SONARJAVA-3509] - Rule S5958: AssertJ "assertThatThrownBy" should not be used alone
  • [SONARJAVA-3511] - Rule S5961: Test methods should not contain too many assertions
  • [SONARJAVA-3514] - Rule S5967: Tests method should not be annotated with competing annotations
  • [SONARJAVA-3515] - Rule S5960: Assertions should not be used in production code
  • [SONARJAVA-3516] - Rule S5969: Mocking all non-private methods of a class should be avoided
  • [SONARJAVA-3517] - Rule S5970: Spring's ModelAndViewAssert assertions should be used instead of other assertions
  • [SONARJAVA-3522] - Rule S3414: Tests should be kept in a dedicated source directory
  • [SONARJAVA-3524] - Rule S5973: Tests should be stable
  • [SONARJAVA-3526] - Rule S5976: Similar tests should be grouped in a single Parameterized test
  • [SONARJAVA-3527] - Rule S5977: Tests should use fixed data instead of randomized data

Task

Improvement

  • [SONARJAVA-3476] - Improve issue location for S5843
  • [SONARJAVA-3481] - Add missing escape sequences to regex parser
  • [SONARJAVA-3485] - Change issue type of S899 to Bug
  • [SONARJAVA-3492] - S1215 should detect "System.runFinalization()" the same way it detects System.gc()
  • [SONARJAVA-3500] - Support latest version of Play framework in S3330 and S2092
  • [SONARJAVA-3513] - Improve S5810 to support static and test methods with return values
  • [SONARJAVA-3518] - S125: reports issue on whole commented block
  • [SONARJAVA-3521] - SuppressWarnings Filter should remove issue of S3740 when "rawTypes" is used
  • [SONARJAVA-3523] - Extend S3415 (Arguments order) to support TestNG assertions
  • [SONARJAVA-3531] - S2187 should consider methods annotated with "@State" from Pact framework as test methods

False-Positive

  • [SONARJAVA-3477] - S1214 should report only when an interface contains only constants
  • [SONARJAVA-3498] - FP in S1193 for instance of non-throwable types
  • [SONARJAVA-3504] - FP on S1948 for fields having non-serializable interface as type but serializable type as initializer
  • [SONARJAVA-3506] - FP in S2275 when second argument of String.format is an array
  • [SONARJAVA-3507] - FP in S3012 when copying array of primitives types to a Collection
  • [SONARJAVA-3519] - FP on S3878 when the argument before the vararg is also an array
  • [SONARJAVA-3528] - FP on S5778 when calling mockito methods
  • [SONARJAVA-3530] - FP on S3577 when test class ends with "Tests" or is an abstract class
  • [SONARJAVA-3534] - FP S3077(VolatileNonPrimitiveFieldCheck) should consider enum as immutable

False Negative

  • [SONARJAVA-3491] - FN S2789 (NullShouldNotBeUsedWithOptionalCheck) on null assignment
  • [SONARJAVA-3501] - FN on Unused Imports when using Lombok
Loading

6.7.0.23054

31 Aug 09:13
6.7.0.23054
3d4657a
Compare
Choose a tag to compare
6.7.0.23054

Release Notes - SonarJava - Version 6.7

Bug

  • [SONARJAVA-3244] - S3065: ClassCastException with implicit type casting
  • [SONARJAVA-3311] - SE should correctly handle new class in catch
  • [SONARJAVA-3381] - Performance Issue when computing the flow of an expression

Task

Improvement

  • [SONARJAVA-3026] - S3518 Division by zero on floats and double should not mention ArithmeticException
  • [SONARJAVA-3069] - Adapt SE engine to Switch Expressions
  • [SONARJAVA-3345] - S3518 (division by zero) should handle BigDecimal and BigInteger
  • [SONARJAVA-3484] - Change issue type of S2039 and S2386 to Code Smell
  • [SONARJAVA-3493] - Remove ASM dependency
  • [SONARJAVA-3494] - Rework S2095 (UnclosedResourceCheck) to remove calls to parent() method

False-Positive

  • [SONARJAVA-2060] - FP in S2095 : java.sql.Statement will implicitly close created ResultSets
  • [SONARJAVA-3043] - S3655 should not raise an issue when a method doing nothing is called between "isPresent" and "get()"
  • [SONARJAVA-3157] - FP on Rule S2637 - issue raised on non-initialized fields
  • [SONARJAVA-3186] - SE based rules should not raise when exiting on exception with unknown type
  • [SONARJAVA-3187] - S2259 FP on null when called Class.isInstance
  • [SONARJAVA-3235] - FP on S3655 when the Optional is a class instance field
  • [SONARJAVA-3238] - FP on S1948 when class has multiple bounds in parameter type
  • [SONARJAVA-3242] - S5164, S1640: FP when variable is called with qualified name
  • [SONARJAVA-3451] - FP in S2095: sessions, producers, and consumers of a closed connection with JMS 2.0.
  • [SONARJAVA-3466] - FP S5845(AssertionTypesCheck) AssertJ is able to compare date/time and string
  • [SONARJAVA-3495] - FP in S2159 when type compared is Unknown
  • [SONARJAVA-3499] - FP on S3749 when using javax.persistence.PersistenceContext
  • [SONARJAVA-3508] - FP on S4449 when using Preconditions.checkNotNull(arg) with a @nullable argument

False Negative

  • [SONARJAVA-2129] - FN on S2095: java.util.Properties.load(InputStream) should not close the stream passed as parameter
  • [SONARJAVA-3447] - FN on S2259 when a method is annotated with spring's annotation @nullable
  • [SONARJAVA-3503] - FN on S3052 when the initializer is a cast expression
Loading

6.6.0.22815

20 Jul 08:54
@sebastian-hungerecker-sonarsource sebastian-hungerecker-sonarsource
6.6.0.22815
aada3ec
Compare
Choose a tag to compare
6.6.0.22815

Release Notes - SonarJava - Version 6.6

Bug

  • [SONARJAVA-3382] - Computing method behavior for Java 14 methods fails
  • [SONARJAVA-3448] - IndexOutOfBoundsException on S5863 when "containsX" is called without argument.
  • [SONARJAVA-3452] - Analysis fails when transpiling JSP with jar stripped of code
  • [SONARJAVA-3453] - JSP files shouldn't be analyzed for SQ < 8.3

New Feature

  • [SONARJAVA-3286] - Support Java 14
  • [SONARJAVA-3404] - Rule S5852: Using slow regular expressions is security-sensitive
  • [SONARJAVA-3412] - Rule S5840: Regex patterns and their sub-patterns should not always fail
  • [SONARJAVA-3413] - Rule S5842: Regex repetition pattern's body should not match the empty String
  • [SONARJAVA-3415] - Rule S5843: Regular expressions should not be too complicated
  • [SONARJAVA-3416] - Rule S5846: Empty lines should not be tested with regex MULTILINE flag
  • [SONARJAVA-3417] - Rule S5850: Alternatives in regular expressions should be grouped when used with anchors
  • [SONARJAVA-3419] - Rule S5854: Regex containing characters subjects to normalization should use the CANON_EQ flag
  • [SONARJAVA-3420] - Rule S5856: Regular expressions should be syntactically valid
  • [SONARJAVA-3421] - Rule S5857: Regular expressions character classes should be preferred over non-greedy quantifiers
  • [SONARJAVA-3422] - Rule S5860: Names of regular expressions named groups should be used
  • [SONARJAVA-3423] - Rule S5866: Case insensitive Unicode regular expressions should enable the “UNICODE_CASE” flag
  • [SONARJAVA-3424] - Rule S5867: Unicode-aware versions of character classes should be preferred
  • [SONARJAVA-3425] - Create a dedicated regex parser to allow implementation of java rules targeting regex
  • [SONARJAVA-3426] - Rule S5868: Unicode Grapheme Clusters should be avoided inside regex character classes
  • [SONARJAVA-3427] - Rule S5869: Character classes in regular expressions should not contain the same character twice

Task

Improvement

  • [SONARJAVA-2163] - S2187 support detecting of test class without tests for classes matched by maven-surefire and gradle
  • [SONARJAVA-3049] - Resolve semantic for switch expression
  • [SONARJAVA-3270] - Update ASM to 8.0.1 for Java 14 support
  • [SONARJAVA-3332] - Upgrade ECJ to 3.22.0 for Java 14 support
  • [SONARJAVA-3434] - S5542: add a secondary location to the insecure cypher declaration
  • [SONARJAVA-3460] - S3457, S2275: Rework printf-style format rules

False-Positive

  • [SONARJAVA-3237] - S1142 should be ignored in equals methods
  • [SONARJAVA-3254] - S3398 Should not suggest to move static method to non-static inner
  • [SONARJAVA-3304] - FP in S2201: support new switch expression
  • [SONARJAVA-3368] - FP in S4276: interfaces with generic wildcard types can't be specialized
  • [SONARJAVA-3369] - FP S1228 (PackageInfoCheck) when there are several source directories
  • [SONARJAVA-3370] - FP S5411 (BoxedBooleanExpressionsCheck) on method invocation having @NotNull
  • [SONARJAVA-3377] - Avoid FP for Google AutoValue classes
  • [SONARJAVA-3379] - FP in S4248 for Pattern in a class annotated with Lombok @UtilityClass
  • [SONARJAVA-3418] - S2275: FP when passing a Throwable as last argument
  • [SONARJAVA-3437] - FP in S2325 due to Lombok "@UtilityClass"
  • [SONARJAVA-3449] - FP on S2141 when equals() without default implementation is defined in an interface
  • [SONARJAVA-3450] - FP on S3973 on valid generated equals methods from IntelliJ
  • [SONARJAVA-3454] - FP in S2970 when "assertThatThrownBy" is used alone
  • [SONARJAVA-3456] - Don't raise S2160 when extending class overriding equals using an abstract definition
  • [SONARJAVA-3461] - FP in S5838: simplification with "isEqualTo" can not always be made on Object assertions
  • [SONARJAVA-3465] - FPs and FNs related to quoting characters in regular expressions

False Negative

  • [SONARJAVA-3400] - FN in S2885(StaticMultithreadedUnsafeFieldsCheck) for DateFormat.getDateInstance()
  • [SONARJAVA-3403] - FN in S4970: support unrelated Exception
  • [SONARJAVA-3440] - FN in S1194: Support extending sub-classes of Error
  • [SONARJAVA-3455] - FN in S2111 for boxed Double and Float
  • [SONARJAVA-3457] - FN in S5361 when using backslashes
  • [SONARJAVA-3459] - FN on S1128 (UselessImportCheck) when comments contain the class name within a word
Loading

6.3.2.22818

20 Jul 08:53
@alban-auzeill alban-auzeill
6.3.2.22818
5bbf311
Compare
Choose a tag to compare
6.3.2.22818 
Fix missing coverage before bug fix release 6.3.2
Loading

6.5.1.22586

02 Jul 12:53
@saberduck saberduck
6.5.1.22586
83734b1
Compare
Choose a tag to compare
6.5.1.22586

Bug fix for JSP transpiling

Loading

6.5.0.22421

19 Jun 15:33
@johann-beleites-sonarsource johann-beleites-sonarsource
6.5.0.22421
37715f4
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
6.5.0.22421 
    Release Notes - SonarJava - Version 6.5

Bug

  • [SONARJAVA-3438] - S5122: ClassCastException when annotation is defined with an identifier

New Feature

  • [SONARJAVA-3384] - Rule S5831: AssertJ configuration should be applied
  • [SONARJAVA-3390] - Rule S5833: AssertJ methods setting the assertion context should come before an assertion
  • [SONARJAVA-3393] - Rule S5838: Chained AssertJ assertions should be simplified to the corresponding dedicated assertion
  • [SONARJAVA-3395] - Rule S5841: AssertJ assertions "allMatch" and "doesNotContains" should also test for emptiness
  • [SONARJAVA-3399] - Rule S5845: Assertions of dissimilar types should not be made
  • [SONARJAVA-3402] - Rule S5853: Consecutive AssertJ "assertThat" statement should be chained
  • [SONARJAVA-3405] - Rule S5863: Assertions should not compare an object to itself

Task

Improvement

  • [SONARJAVA-3349] - S2698: support AssertJ assertions without message
  • [SONARJAVA-3351] - Rule S5826: Methods setUp() and tearDown() should be correctly annotated starting with JUnit4
  • [SONARJAVA-3383] - S5783 and S5778: Support AssertJ
  • [SONARJAVA-3389] - S2698: improve issue reporting
  • [SONARJAVA-3397] - S3658, S5778, S5779, S5783 support AssertJ "fail"
  • [SONARJAVA-3398] - S2970(AssertionsCompletenessCheck) should support all AssertJ assertions
  • [SONARJAVA-3401] - Extend S3415 (Arguments order) to support AssertJ assertions
  • [SONARJAVA-3432] - S2479: support whitespace and control characters in "char"
  • [SONARJAVA-3435] - S1214: add secondary locations to interface's constants
  • [SONARJAVA-3442] - FN in S2133: detect getClass called on new array
  • [SONARJAVA-3444] - Deprecate 10 security-hotspot rules that overlap with security-injection rules
  • [SONARJAVA-3445] - Deprecate S4787 in favor of cryptography rules
  • [SONARJAVA-3446] - Deprecate S2255 and S3331 not considered anymore as sensitive

False-Positive

  • [SONARJAVA-3386] - FP on S2187 when test class is a JUnit4 test class also inheriting from a JUnit3 TestCase
  • [SONARJAVA-3394] - FP in S3749 when spring class is not a singleton
  • [SONARJAVA-3429] - FP in S2384, S2386: support common method returning unmodifiable collections
  • [SONARJAVA-3431] - S3415: better support of constant used as actual value
  • [SONARJAVA-3441] - FP in S1174 when "finalize()" is not from Object.
Loading

6.4.0.21967

14 May 12:50
@quentin-jaquier-sonarsource quentin-jaquier-sonarsource
6.4.0.21967
eae1272
Compare
Choose a tag to compare
6.4.0.21967 
    Release Notes - SonarSource Code Analyzer for Java - Version 6.4

False-Positive

  • [SONARJAVA-3324] - FP in S2970 when using JUnit 5 Soft assertions extension.
  • [SONARJAVA-3357] - S1452: java Collectors second parameter should be excluded
  • [SONARJAVA-3358] - S1604: don't report method with annotations
  • [SONARJAVA-3378] - FP in S1612 when lambda argument is a subtype of ambiguous method parameter

Bug

  • [SONARJAVA-3375] - FP S2973(EscapedUnicodeCharactersCheck) with Unicode Whitespaces
  • [SONARJAVA-3380] - Sourcemap for JSP can have multiple input files
  • [SONARJAVA-3385] - NPE in JSymbol when searching the enclosing class of a variable within an interface

New Feature

  • [SONARJAVA-2794] - Rule S2479: Newline and control characters should not be used in string literals
  • [SONARJAVA-2944] - Rule S4970: Derived exceptions should not hide their parents catch block
  • [SONARJAVA-3258] - Rule S5669: Vararg method arguments should not be confusing
  • [SONARJAVA-3353] - Rule S5776: Exception testing via JUnit ExpectedException rule should not be mixed with other assertions
  • [SONARJAVA-3354] - Rule S5777: Exception testing via JUnit @test annotation should be avoided
  • [SONARJAVA-3356] - Rule S5779: Assertion methods should not be used within the try block of a try-catch catching an Error
  • [SONARJAVA-3359] - Rule S5783: Only one method invocation is expected when testing checked exceptions
  • [SONARJAVA-3360] - Rule S5778: Only one method invocation is expected when testing runtime exceptions
  • [SONARJAVA-3361] - Rule S5785: JUnit assertTrue/assertFalse should be simplified to its dedicated assertion
  • [SONARJAVA-3362] - Rule S5786: JUnit5 test classes and methods should have default package visibility
  • [SONARJAVA-3366] - Rule S5790: JUnit5 nested test classes should be annotated with @nested
  • [SONARJAVA-3367] - Rule S5793: Migrate your tests from JUnit4 to the new JUnit5 annotations
  • [SONARJAVA-3373] - Rule S5810: JUnit5 test classes and methods should not have private visibility

Task

Improvement

Loading