SONARJAVA-6703 Implement new rule S9133

[romainbrenguier]

Detect hard-coded floating-point literals that approximate well-known mathematical constants (pi, e, sqrt(2), ln(2)) and suggest using the corresponding Math class constants or expressions instead.

Part of

[hashicorp-vault-sonar-prod]

SONARJAVA-6703

[github-actions]

❌ Ruling needs updating. A fix PR has been created: #5863

Please review and merge it into your branch.

[github-actions]

Ruling Diff Summary

Detected changes in 1 rule files: 0 issues removed, 18 issues added.

S9133 (java) on sonar-server - 0 issues removed, 18 issues added - new ruling file

Added src/test/java/org/sonar/server/computation/task/projectanalysis/issue/TrackerRawInputFactoryTest.java (line 103)

(source file not found at this revision: src/test/java/org/sonar/server/computation/task/projectanalysis/issue/TrackerRawInputFactoryTest.java)

Added src/test/java/org/sonar/server/computation/task/projectanalysis/issue/TrackerRawInputFactoryTest.java (line 116)

(source file not found at this revision: src/test/java/org/sonar/server/computation/task/projectanalysis/issue/TrackerRawInputFactoryTest.java)

Added src/test/java/org/sonar/server/computation/task/projectanalysis/issue/TrackerRawInputFactoryTest.java (line 117)

(source file not found at this revision: src/test/java/org/sonar/server/computation/task/projectanalysis/issue/TrackerRawInputFactoryTest.java)

Added src/test/java/org/sonar/server/computation/task/projectanalysis/step/CustomMeasuresCopyStepTest.java (line 106)

(source file not found at this revision: src/test/java/org/sonar/server/computation/task/projectanalysis/step/CustomMeasuresCopyStepTest.java)

Added src/test/java/org/sonar/server/computation/task/projectanalysis/step/CustomMeasuresCopyStepTest.java (line 144)

(source file not found at this revision: src/test/java/org/sonar/server/computation/task/projectanalysis/step/CustomMeasuresCopyStepTest.java)

Added src/test/java/org/sonar/server/issue/IssueDocTesting.java (line 43)

(source file not found at this revision: src/test/java/org/sonar/server/issue/IssueDocTesting.java)

Added src/test/java/org/sonar/server/issue/IssueFieldsSetterTest.java (line 352)

(source file not found at this revision: src/test/java/org/sonar/server/issue/IssueFieldsSetterTest.java)

Added src/test/java/org/sonar/server/issue/IssueFieldsSetterTest.java (line 355)

(source file not found at this revision: src/test/java/org/sonar/server/issue/IssueFieldsSetterTest.java)

Added src/test/java/org/sonar/server/issue/IssueFieldsSetterTest.java (line 361)

(source file not found at this revision: src/test/java/org/sonar/server/issue/IssueFieldsSetterTest.java)

Added src/test/java/org/sonar/server/measure/custom/ws/CustomMeasureValidatorTest.java (line 73)

(source file not found at this revision: src/test/java/org/sonar/server/measure/custom/ws/CustomMeasureValidatorTest.java)

Added src/test/java/org/sonar/server/util/RubyUtilsTest.java (line 91)

(source file not found at this revision: src/test/java/org/sonar/server/util/RubyUtilsTest.java)

Added src/test/java/org/sonar/server/util/RubyUtilsTest.java (line 92)

(source file not found at this revision: src/test/java/org/sonar/server/util/RubyUtilsTest.java)

[gitar-bot]

Code Review ✅ Approved 2 resolved / 2 findings

Implements rule S9133 to detect hard-coded floating-point approximations of mathematical constants, addressing the loose tolerance and normalize() edge case test coverage findings.

✅ 2 resolved

✅ Edge Case: Loose tolerance may flag legitimate 3-digit domain values

📄 java-checks/src/main/java/org/sonar/java/checks/HardcodedMathConstantCheck.java:28-29 📄 java-checks/src/main/java/org/sonar/java/checks/HardcodedMathConstantCheck.java:79-85
With RELATIVE_TOLERANCE=0.002 and only MIN_SIGNIFICANT_DIGITS=3, a literal that matches a constant only in its first ~3 digits (e.g. 2.72 for E, or 0.693 which is a common domain value) is flagged even though the author clearly did not intend the constant's full precision. This can create false positives on genuine domain literals. Consider requiring the literal to match the constant across all of its own significant digits (i.e., the error should be on the order of the literal's own rounding) rather than a fixed relative window, to reduce noise while still catching approximations like 3.14159.

✅ Quality: No tests for normalize() edge cases (underscores, D suffix, leading dot)

📄 java-checks/src/main/java/org/sonar/java/checks/HardcodedMathConstantCheck.java:88-102 📄 java-checks-test-sources/default/src/main/java/checks/HardcodedMathConstantCheckSample.java:1-15
normalize() handles digit separators ("3.14_159"), upper/lower 'd'/'D'/'F' suffixes, and the sample covers 'f' and 'e'/hex, but there is no test exercising an underscore-separated literal, a 'D'/'d' suffixed double, or a leading-dot literal (e.g. ".314159e1"). Add sample lines such as double a = 3.14_159; and double b = 3.14159d; to lock in this normalization behavior against regressions.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
97.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube