SONARJAVA-6305 Fix the expected exceptions filter to work without semantic information by aurelien-coet-sonarsource · Pull Request #5626 · SonarSource/sonar-java

aurelien-coet-sonarsource · 2026-05-22T11:54:09Z

Summary by Gitar

Refactored checks:
- Renamed InstantConversionsCheck to DateTimeConversionsCheck to reflect its broadened scope.
Implemented new logic:
- Added detection for invalid date-time conversions involving LocalDate, LocalTime, and ZonedDateTime types.
- Enhanced ExpectedExceptionFilter to allow these conversions to work correctly without full semantic information.
Expanded test coverage:
- Added DateTimeConversionsCheckSample and DateTimeConversionsCheckTest to verify the new detection logic.
- Added additional test cases in ExpectedExceptionFilter.java to validate filter behavior with various exception types and signatures.

_{This will update automatically on new commits.}

sonarqubecloud · 2026-05-22T11:54:20Z

Agentic Analysis: Early Results

Agentic Analysis and Context Augmentation are available on your project. Here are some issues that could have been prevented. Follow the links to learn how to put them into action.

5 issue(s) found across 1 file(s):

Rule	File	Line	Message
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	157	The return value of "from" must be used.
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	166	The return value of "from" must be used.
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	171	The return value of "from" must be used.
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	187	The return value of "from" must be used.
`java:S2201`	`java-checks/src/test/files/filters/ExpectedExceptionFilter.java`	192	The return value of "from" must be used.

_{Analyzed by SonarQube Agentic Analysis in 5.5 s}

hashicorp-vault-sonar-prod · 2026-05-22T11:54:24Z

SONARJAVA-6305

gitar-bot · 2026-05-26T08:26:40Z

Code Review ✅ Approved 2 resolved / 2 findings

Refactored the expected exceptions filter to function without semantic information and renamed the conversion check to broaden its scope. Addressed an unchecked argument index access and a duplicate test method name.

✅ 2 resolved

✅ Quality: Duplicate method name in test file

📄 java-checks/src/test/files/filters/ExpectedExceptionFilter.java:158 📄 java-checks/src/test/files/filters/ExpectedExceptionFilter.java:162
The test file defines two methods both named methodAnnotationWithoutSemantics (lines 158 and 162). While Java allows method overloading, these methods have the same signature (both take no arguments and return void), which will cause a compilation error.

✅ Edge Case: Unchecked argument index access may throw IndexOutOfBoundsException

📄 java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java:128 📄 java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java:137-138 📄 java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java:130-135
The refactoring replaced MethodMatchers (which validated parameter count via addParametersMatcher) with name-based matching, but didn't add equivalent bounds checks on argument lists. If a method with the same name but a different signature is encountered (plausible since this is name-only matching), arguments.get(1) or arguments.get(0) will throw IndexOutOfBoundsException.

Three sites are affected:

Line 128: catchThrowableOfType accesses arguments.get(1) without checking arguments.size() >= 2

Line 137: assertThatExceptionOfType/thenExceptionOfType accesses arguments.get(0) without checking non-empty

Line 138: isThrownBy accesses mit.arguments().get(0) without checking non-empty

Since the filter now intentionally matches by name alone, it's more likely to encounter unexpected method signatures.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

NoemieBenard

Overall LGTM and should work for the FPs that we have, just some comments

NoemieBenard · 2026-05-26T12:59:05Z

+    }
+  }
+
+  // When semantic information is missing, the filter should conservatively activate.


Is it really about semantic here ?

Yes, here this is an example that wouldn't even compile, because @Test is used without a fully qualified path and there is no import for the annotation, so when the filter processes the annotation it doesn't know its actual type. However, since the annotation looks like a test annotation that matches the criteria for the filter, we still want to trigger it.

NoemieBenard · 2026-05-26T13:01:23Z

+  @Test(expected = DateTimeException)
+  void wrongExpectedType() {
+    Instant.from(date); // WithIssue
+  }
+
+  @Test(expect = DateTimeException.class)
+  void wrongAnnotationAttribute() {
+    Instant.from(date); // WithIssue
+  }
+
+  @Test
+  void wrongAssertMethodSignature() {
+    assertThrows(Instant.from(date)); // WithIssue
+    catchThrowableOfType(Instant.from(date)); // WithIssue


I wonder if we are not being too strict with these tests, we could prevent the filter from activating on patterns that we don't recognize even though they are correct. (but maybe we can keep it as it is for now, WDYT?)

I think we don't want to trigger the filter in cases where we do not have enough information to know what specific exceptions are expected. Here, we cannot know if the intent of the user was to assert that the call throws a DateTimeException or one of its super/sub-classes. WDYT ?

Yes, but we could say that we don't raise if there is any indication that an exception is expected, risking false negatives but avoiding false positives on specific behavior intended by the developer (but I am not sure this can happen). Anyway I think for now the way you did it is fine and we'll have feedback later if there are any issues

NoemieBenard · 2026-05-26T13:45:05Z

This looks nicer IMO:

Suggested change

if (expression instanceof MemberSelectExpressionTree memberSelect

&& "class".equals(memberSelect.identifier().name())) {

return Optional.of(memberSelect.expression().symbolType());

}

NoemieBenard · 2026-05-26T13:49:21Z

 import org.sonar.plugins.java.api.tree.UnionTypeTree;

+import static org.sonar.java.checks.helpers.MethodTreeUtils.consecutiveMethodInvocation;
 import static org.sonar.java.checks.helpers.UnitTestUtils.isTryCatchFail;


The unused import should be removed

sonarqube-next · 2026-05-27T07:19:28Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
90.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

NoemieBenard

LGTM

gitar-bot · 2026-05-27T07:47:21Z

Code Review ✅ Approved 2 resolved / 2 findings

Updates the expected exceptions filter to support non-semantic analysis and renames the conversion check for broader scope, addressing previous index access and naming concerns. No further issues found.

✅ 2 resolved

✅ Quality: Duplicate method name in test file

📄 java-checks/src/test/files/filters/ExpectedExceptionFilter.java:158 📄 java-checks/src/test/files/filters/ExpectedExceptionFilter.java:162
The test file defines two methods both named methodAnnotationWithoutSemantics (lines 158 and 162). While Java allows method overloading, these methods have the same signature (both take no arguments and return void), which will cause a compilation error.

✅ Edge Case: Unchecked argument index access may throw IndexOutOfBoundsException

📄 java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java:128 📄 java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java:137-138 📄 java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java:130-135
The refactoring replaced MethodMatchers (which validated parameter count via addParametersMatcher) with name-based matching, but didn't add equivalent bounds checks on argument lists. If a method with the same name but a different signature is encountered (plausible since this is name-only matching), arguments.get(1) or arguments.get(0) will throw IndexOutOfBoundsException.

Three sites are affected:

Line 128: catchThrowableOfType accesses arguments.get(1) without checking arguments.size() >= 2

Line 137: assertThatExceptionOfType/thenExceptionOfType accesses arguments.get(0) without checking non-empty

Line 138: isThrownBy accesses mit.arguments().get(0) without checking non-empty

Since the filter now intentionally matches by name alone, it's more likely to encounter unexpected method signatures.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

Fix the expected exceptions filter to work without semantic information

b56ee32

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 11:54 — with GitHub Actions Inactive

gitar-bot Bot reviewed May 22, 2026

View reviewed changes

Comment thread java-checks/src/main/java/org/sonar/java/filters/ExpectedExceptionFilter.java Outdated

gitar-bot Bot reviewed May 22, 2026

View reviewed changes

Comment thread java-checks/src/test/files/filters/ExpectedExceptionFilter.java Outdated

Apply review bot suggestion

46294e6

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 11:58 — with GitHub Actions Inactive

Add guards to accesses to arguments indexes

b602d8d

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 12:07 — with GitHub Actions Inactive

Reduce cognitive complexity of the excludeExpectedExceptions method

3514ab7

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 12:16 — with GitHub Actions Inactive

Increase test coverage

bf9ab7a

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 14:23 — with GitHub Actions Inactive

Increase test coverage again

b019106

aurelien-coet-sonarsource temporarily deployed to sca-checking May 22, 2026 14:38 — with GitHub Actions Inactive

aurelien-coet-sonarsource marked this pull request as ready for review May 22, 2026 14:46

aurelien-coet-sonarsource requested a review from NoemieBenard May 22, 2026 14:46

Rename the InsantConversionsCheck class to DateTimeConversionsCheck

2b7cde7

aurelien-coet-sonarsource temporarily deployed to sca-checking May 26, 2026 08:24 — with GitHub Actions Inactive

Fix the filter when no semantics are available

08566ed

NoemieBenard reviewed May 26, 2026

View reviewed changes

Apply review suggestions

02ab3f7

aurelien-coet-sonarsource temporarily deployed to sca-checking May 27, 2026 07:11 — with GitHub Actions Inactive

aurelien-coet-sonarsource requested a review from NoemieBenard May 27, 2026 07:18

NoemieBenard approved these changes May 27, 2026

View reviewed changes

aurelien-coet-sonarsource merged commit c04a0eb into master May 27, 2026
18 checks passed

aurelien-coet-sonarsource deleted the ac/SONARJAVA-6305-2 branch May 27, 2026 07:46

+if (expression instanceof MemberSelectExpressionTree memberSelect
+      && "class".equals(memberSelect.identifier().name())) {
+      return Optional.of(memberSelect.expression().symbolType());
+    }

Conversation

aurelien-coet-sonarsource commented May 22, 2026 • edited by gitar-bot Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Gitar

Uh oh!

sonarqubecloud Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Agentic Analysis: Early Results

Uh oh!

hashicorp-vault-sonar-prod Bot commented May 22, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gitar-bot Bot commented May 26, 2026

Uh oh!

NoemieBenard left a comment

Choose a reason for hiding this comment

Uh oh!

NoemieBenard May 26, 2026

Choose a reason for hiding this comment

Uh oh!

aurelien-coet-sonarsource May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NoemieBenard May 26, 2026

Choose a reason for hiding this comment

Uh oh!

aurelien-coet-sonarsource May 27, 2026

Choose a reason for hiding this comment

Uh oh!

NoemieBenard May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NoemieBenard May 26, 2026

Choose a reason for hiding this comment

Uh oh!

NoemieBenard May 26, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqube-next Bot commented May 27, 2026

Quality Gate passed

Uh oh!

NoemieBenard left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gitar-bot Bot commented May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aurelien-coet-sonarsource commented May 22, 2026 •

edited by gitar-bot Bot

Loading

sonarqubecloud Bot commented May 22, 2026 •

edited

Loading

hashicorp-vault-sonar-prod Bot commented May 22, 2026 •

edited by atlassian Bot

Loading

aurelien-coet-sonarsource May 27, 2026 •

edited

Loading

NoemieBenard May 27, 2026 •

edited

Loading