Skip to content

SONARJAVA-6078 ScopedValue where result is ignored#5441

Draft
rombirli wants to merge 15 commits intomasterfrom
rombirli/SONARJAVA-6078-scopedvalue-where-result-ignored
Draft

SONARJAVA-6078 ScopedValue where result is ignored#5441
rombirli wants to merge 15 commits intomasterfrom
rombirli/SONARJAVA-6078-scopedvalue-where-result-ignored

Conversation

@rombirli
Copy link
Contributor

@rombirli rombirli commented Feb 5, 2026

@hashicorp-vault-sonar-prod
Copy link

hashicorp-vault-sonar-prod bot commented Feb 5, 2026

SONARJAVA-6078

… lambdas, variable reassignment, multiple var same carrier...
@rombirli
Copy link
Contributor Author

rombirli commented Feb 5, 2026

I tried to cover as many edge cases as possible, but let's look at the following example :

void A() {
  var carrier = ScopedValue.where(SCOPED, "hello"); // FN carrier is not used
  identity(carrier); // the rule consider carrier escapes from the function A with this call
}

ScopedValue.Carrier identity(ScopedValue.Carrier carrier) {
  return carrier; // the rule consider carrier escapes from the function identity with this return
}

I think the only way to implement this rule properly would be with CFG/symbolic execution

Copy link
Contributor

@asya-vorobeva asya-vorobeva left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, but I can't validate such PR, too AI-generated. Common things that I'd recommend:

  • try to reduce Sample files (a lot of things to test are redundant)
  • try to restructure Check file, now it's too much boilerplate and very hard to maintain.

}

void escapedCarrierFunctionCall() {
var carrier = ScopedValue.where(myScopedValue, "hello"); // ccompliant - the result escapes
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Spellcheck

ScopedValue.where(myScopedValue, "hello").get(myScopedValue); // Noncompliant
ScopedValue.where(myScopedValue, "hello").run(() -> {
}); // Compliant, the result is used immediately
ScopedValue.where(myScopedValue, "hello").where(ScopedValue.newInstance(), "hello").run(() -> {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like this example. The second chain call .where(ScopedValue.newInstance(), "hello") looks weird and should raise an issue (probably another rule?). We can't use such binding if it's unassigned. The same applies for myUnused2LevelCarrier below.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants