SONARJAVA-6706 Implement new rule S2330

[romainbrenguier]

Detect array covariance where an array of a derived type is assigned to a variable declared as an array of its base type, which can lead to ArrayStoreException at runtime.

[hashicorp-vault-sonar-prod]

SONARJAVA-6706

[gitar-bot]

💡 Edge Case: Expression-bodied lambdas escape covariance detection

The return-path handling only fires on Tree.Kind.RETURN_STATEMENT, but an expression-bodied lambda such as Supplier<Fruit[]> s = () -> new Apple[1]; has no return statement node (its body is an ExpressionTree, not a block with a return). Such covariant lambda bodies are therefore never checked, a false negative compared to the block-lambda case that is tested at ArrayCovarianceCheckSample.java:85-89. Consider also handling LAMBDA_EXPRESSION nodes directly: when the body is an ExpressionTree, compare lambda.symbol().returnType().type() against the body expression's type.

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

CI failed: 1 ruling test failure in the integration test suite caused by new rule S2330 producing unexpected issue differences against the baseline.

Overview

1 ruling integration test failure was observed where the new rule S2330 introduced 63 issue differences against the expected baseline during JavaRulingTest.sonarqube_server execution.

Failures

Ruling Test Baseline Mismatch from New Rule S2330 (confidence: high)

• Type: test
• Affected jobs: 91689140595
• Related to change: yes
• Root cause: The newly implemented rule S2330 (ArrayCovarianceCheck) produces new issues during the SonarQube integration ruling test, causing a mismatch against the expected baseline results (63 differences found).
• Suggested fix: Review the issues reported by rule S2330 in the ruling test execution, and update the expected ruling test baselines or rule configuration/filters to account for the new rule's findings.

Summary

• Change-related failures: 1 integration ruling test failure resulting from the new rule implementation producing baseline differences.
• Infrastructure/flaky failures: None
• Recommended action: Update the ruling test baselines or refine the rule S2330 implementation to match expected output.

Code Review 👍 Approved with suggestions 0 resolved / 1 findings

Implements rule S2330 to detect unsafe array covariance and prevent runtime ArrayStoreExceptions. Expression-bodied lambdas currently escape covariance detection and should be handled in return-path logic.

💡 Edge Case: Expression-bodied lambdas escape covariance detection

📄 java-checks/src/main/java/org/sonar/java/checks/ArrayCovarianceCheck.java:79-91

The return-path handling only fires on Tree.Kind.RETURN_STATEMENT, but an expression-bodied lambda such as Supplier<Fruit[]> s = () -> new Apple[1]; has no return statement node (its body is an ExpressionTree, not a block with a return). Such covariant lambda bodies are therefore never checked, a false negative compared to the block-lambda case that is tested at ArrayCovarianceCheckSample.java:85-89. Consider also handling LAMBDA_EXPRESSION nodes directly: when the body is an ExpressionTree, compare lambda.symbol().returnType().type() against the body expression's type.

🤖 Prompt for agents

Code Review: Implements rule S2330 to detect unsafe array covariance and prevent runtime ArrayStoreExceptions. Expression-bodied lambdas currently escape covariance detection and should be handled in return-path logic.

1. 💡 Edge Case: Expression-bodied lambdas escape covariance detection
   Files: java-checks/src/main/java/org/sonar/java/checks/ArrayCovarianceCheck.java:79-91

   The return-path handling only fires on Tree.Kind.RETURN_STATEMENT, but an expression-bodied lambda such as `Supplier<Fruit[]> s = () -> new Apple[1];` has no return statement node (its body is an ExpressionTree, not a block with a return). Such covariant lambda bodies are therefore never checked, a false negative compared to the block-lambda case that is tested at ArrayCovarianceCheckSample.java:85-89. Consider also handling LAMBDA_EXPRESSION nodes directly: when the body is an ExpressionTree, compare `lambda.symbol().returnType().type()` against the body expression's type.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate failed

Failed conditions
79.3% Coverage on New Code (required ≥ 90%)

See analysis details on SonarQube

[github-actions]

❌ Ruling needs updating. A fix PR has been created: #5868

Please review and merge it into your branch.