SONARJAVA-6305 Fix the expected exceptions filter to work without semantic information by aurelien-coet-sonarsource · Pull Request #5626 · SonarSource/sonar-java

aurelien-coet-sonarsource · 2026-05-22T11:54:09Z

Summary by Gitar

Refactored checks:
- Renamed InstantConversionsCheck to DateTimeConversionsCheck to reflect its broadened scope.
Implemented new logic:
- Added detection for invalid date-time conversions involving LocalDate, LocalTime, and ZonedDateTime types.
- Enhanced ExpectedExceptionFilter to allow these conversions to work correctly without full semantic information.
Expanded test coverage:
- Added DateTimeConversionsCheckSample and DateTimeConversionsCheckTest to verify the new detection logic.
- Added additional test cases in ExpectedExceptionFilter.java to validate filter behavior with various exception types and signatures.

_{This will update automatically on new commits.}

sonarqubecloud · 2026-05-22T11:54:20Z

Agentic Analysis: Early Results

Agentic Analysis and Context Augmentation are available on your project. Here are some issues that could have been prevented. Follow the links to learn how to put them into action.

5 issue(s) found across 1 file(s):

Rule	File	Line	Message
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	157	The return value of "from" must be used.
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	166	The return value of "from" must be used.
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	171	The return value of "from" must be used.
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	187	The return value of "from" must be used.
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	192	The return value of "from" must be used.

_{Analyzed by SonarQube Agentic Analysis in 5.5 s}

hashicorp-vault-sonar-prod · 2026-05-22T11:54:24Z

SONARJAVA-6305

gitar-bot · 2026-05-26T08:26:40Z

Code Review ✅ Approved 2 resolved / 2 findings

Refactored the expected exceptions filter to function without semantic information and renamed the conversion check to broaden its scope. Addressed an unchecked argument index access and a duplicate test method name.

✅ 2 resolved

✅ Quality: Duplicate method name in test file

📄 java-checks/src/test/files/filters/ExpectedExceptionFilter.java:158 📄 java-checks/src/test/files/filters/ExpectedExceptionFilter.java:162
The test file defines two methods both named methodAnnotationWithoutSemantics (lines 158 and 162). While Java allows method overloading, these methods have the same signature (both take no arguments and return void), which will cause a compilation error.

✅ Edge Case: Unchecked argument index access may throw IndexOutOfBoundsException

📄 java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java:128 📄 java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java:137-138 📄 java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java:130-135
The refactoring replaced MethodMatchers (which validated parameter count via addParametersMatcher) with name-based matching, but didn't add equivalent bounds checks on argument lists. If a method with the same name but a different signature is encountered (plausible since this is name-only matching), arguments.get(1) or arguments.get(0) will throw IndexOutOfBoundsException.

Three sites are affected:

Line 128: catchThrowableOfType accesses arguments.get(1) without checking arguments.size() >= 2

Line 137: assertThatExceptionOfType/thenExceptionOfType accesses arguments.get(0) without checking non-empty

Line 138: isThrownBy accesses mit.arguments().get(0) without checking non-empty

Since the filter now intentionally matches by name alone, it's more likely to encounter unexpected method signatures.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

sonarqube-next · 2026-05-26T08:33:25Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
90.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

NoemieBenard

Overall LGTM and should work for the FPs that we have, just some comments

NoemieBenard · 2026-05-26T12:59:05Z

+    }
+  }
+
+  // When semantic information is missing, the filter should conservatively activate.


Is it really about semantic here ?

NoemieBenard · 2026-05-26T13:01:23Z

+  @Test(expected = DateTimeException)
+  void wrongExpectedType() {
+    Instant.from(date); // WithIssue
+  }
+
+  @Test(expect = DateTimeException.class)
+  void wrongAnnotationAttribute() {
+    Instant.from(date); // WithIssue
+  }
+
+  @Test
+  void wrongAssertMethodSignature() {
+    assertThrows(Instant.from(date)); // WithIssue
+    catchThrowableOfType(Instant.from(date)); // WithIssue


I wonder if we are not being too strict with these tests, we could prevent the filter from activating on patterns that we don't recognize even though they are correct. (but maybe we can keep it as it is for now, WDYT?)

NoemieBenard · 2026-05-26T13:45:05Z

    if (expression.is(Tree.Kind.MEMBER_SELECT)) {
      MemberSelectExpressionTree memberSelect = (MemberSelectExpressionTree) expression;
      if ("class".equals(memberSelect.identifier().name())) {
        return Optional.of(memberSelect.expression().symbolType());
      }
    }


This looks nicer IMO:

Suggested change

if (expression instanceof MemberSelectExpressionTree memberSelect

&& "class".equals(memberSelect.identifier().name())) {

return Optional.of(memberSelect.expression().symbolType());

}

NoemieBenard · 2026-05-26T13:49:21Z

 import org.sonar.plugins.java.api.tree.UnionTypeTree;

+import static org.sonar.java.checks.helpers.MethodTreeUtils.consecutiveMethodInvocation;
 import static org.sonar.java.checks.helpers.UnitTestUtils.isTryCatchFail;


The unused import should be removed

Fix the expected exceptions filter to work without semantic information

b56ee32

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 11:54 — with GitHub Actions Inactive

gitar-bot Bot reviewed May 22, 2026

View reviewed changes

Comment thread java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java Outdated

gitar-bot Bot reviewed May 22, 2026

View reviewed changes

Comment thread java-checks/src/test/files/filters/ExpectedExceptionFilter.java Outdated

Apply review bot suggestion

46294e6

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 11:58 — with GitHub Actions Inactive

Add guards to accesses to arguments indexes

b602d8d

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 12:07 — with GitHub Actions Inactive

Reduce cognitive complexity of the excludeExpectedExceptions method

3514ab7

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 12:16 — with GitHub Actions Inactive

Increase test coverage

bf9ab7a

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 14:23 — with GitHub Actions Inactive

Increase test coverage again

b019106

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 14:38 — with GitHub Actions Inactive

aurelien-coet-sonarsource marked this pull request as ready for review May 22, 2026 14:46

aurelien-coet-sonarsource requested a review from NoemieBenard May 22, 2026 14:46

Rename the InsantConversionsCheck class to DateTimeConversionsCheck

2b7cde7

aurelien-coet-sonarsource temporarily deployed to sca-checking May 26, 2026 08:24 — with GitHub Actions Inactive

Fix the filter when no semantics are available

08566ed

NoemieBenard reviewed May 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SONARJAVA-6305 Fix the expected exceptions filter to work without semantic information#5626

SONARJAVA-6305 Fix the expected exceptions filter to work without semantic information#5626
aurelien-coet-sonarsource wants to merge 8 commits into
masterfrom
ac/SONARJAVA-6305-2

aurelien-coet-sonarsource commented May 22, 2026 •

edited by gitar-bot Bot

Loading

Uh oh!

sonarqubecloud Bot commented May 22, 2026 •

edited

Loading

Uh oh!

hashicorp-vault-sonar-prod Bot commented May 22, 2026 •

edited by atlassian Bot

Loading

Uh oh!

Uh oh!

Uh oh!

gitar-bot Bot commented May 26, 2026

Uh oh!

sonarqube-next Bot commented May 26, 2026

Uh oh!

NoemieBenard left a comment

Uh oh!

NoemieBenard May 26, 2026

Uh oh!

NoemieBenard May 26, 2026

Uh oh!

NoemieBenard May 26, 2026

Uh oh!

NoemieBenard May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

+if (expression instanceof MemberSelectExpressionTree memberSelect
+      && "class".equals(memberSelect.identifier().name())) {
+      return Optional.of(memberSelect.expression().symbolType());
+    }

Conversation

aurelien-coet-sonarsource commented May 22, 2026 • edited by gitar-bot Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Gitar

Uh oh!

sonarqubecloud Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Agentic Analysis: Early Results

Uh oh!

hashicorp-vault-sonar-prod Bot commented May 22, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gitar-bot Bot commented May 26, 2026

Uh oh!

sonarqube-next Bot commented May 26, 2026

Quality Gate passed

Uh oh!

NoemieBenard left a comment

Choose a reason for hiding this comment

Uh oh!

NoemieBenard May 26, 2026

Choose a reason for hiding this comment

Uh oh!

NoemieBenard May 26, 2026

Choose a reason for hiding this comment

Uh oh!

NoemieBenard May 26, 2026

Choose a reason for hiding this comment

Uh oh!

NoemieBenard May 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aurelien-coet-sonarsource commented May 22, 2026 •

edited by gitar-bot Bot

Loading

sonarqubecloud Bot commented May 22, 2026 •

edited

Loading

hashicorp-vault-sonar-prod Bot commented May 22, 2026 •

edited by atlassian Bot

Loading