解决SonarQube分析结果不准确的问题

本示例代码演示如何解决在使用SonarQube进行代码静态分析时，分析结果不准确的问题。该问题通常发生在代码中存在使用反射、动态代理等技术的情况下，这些技术使得代码在编译时无法完全确定执行路径，从而导致SonarQube分析结果偏差甚至失效的问题。

@Rules(
    rules = {
        "java:S2068"
    }
)
public void validateReflectiveAccess(JavaFileScannerContext context) {
    final SemanticModel semanticModel = context.getSemanticModel();
    Collection<Tree> trees = semanticModel.getTrees(semanticModel.getClassSymbol(context.getTree()));
    for (Tree tree : trees) {
        if (tree.is(Tree.Kind.NEW_CLASS)) {
            final NewClassTree newClassTree = (NewClassTree) tree;
            final Symbol.TypeSymbol symbol = semanticModel.getSymbol(newClassTree);
            if (symbol == null) {
                return;
            }
            newClassTree.getArguments().stream()
                    .filter(arg -> arg.getKind() == Tree.Kind.METHOD_INVOCATION)
                    .map(MethodInvocationTree.class::cast)
                    .forEach(invocation -> {
                        final Symbol.MethodSymbol methodSymbol = semanticModel.getSymbols().getInvocationSymbol(invocation);
                        if (methodSymbol == null) {
                            return;
                        }
                        if (methodSymbol.owner().typeArguments().isEmpty()) {
                            context.reportIssue(
                                    invocation,
                                    "Use \"LambdaMetafactory\" to create a \"java.lang.invoke.MethodHandle\" instead of using reflection.");
                            return;
                        }
                        final String ownerType = ((Symbol.TypeSymbol) methodSymbol.owner()).getQualifiedName().toString();
                        final String methodName = methodSymbol.name();
                        if (isOnUnsafeType(methodSymbol.owner())) {
                            final boolean usesUnsafe = isUnsafeMethodInvocation(methodSymbol, invocation, semanticModel);
                            if (usesUnsafe) {
                                context.reportIssue(
                                        invocation,
                                        String.format("Use \"%1$s.%2$s\" instead of using reflection.", ownerType, methodName));
                            }
                        } else if (isOnJAXBContextType(methodSymbol.owner())) {
                            final boolean usesJAXB = isJAXBMethodInvocation(methodSymbol, invocation, semanticModel, context);
                            if (usesJAXB) {
                                context.reportIssue(
                                        invocation,
                                        String.format("Use \"%1$s.%2$s\" instead of using reflection.", ownerType, methodName));
                            }
                        }
                    });
        }
    }
}

免责申明：文章和图片全部来源于公开网络，如有侵权，请通知删除 server@dude6.com