SONARJAVA-6489: Implement rule S8909 - Quarkus CacheKeyGenerator should be instantiable

.github/workflows/ToggleLockBranch.yml

@@ -25,4 +25,4 @@ jobs:
           github-token: ${{ fromJSON(steps.secrets.outputs.vault).lock_token }}
           slack-token: ${{ fromJSON(steps.secrets.outputs.vault).slack_api_token }}
           additional-message: ${{ github.event.inputs.additional-message }}
-          slack-channel: squad-jvm-notifs
+          slack-channel: squad-corelang-releases

.github/workflows/automated-release.yml

@@ -68,7 +68,7 @@ jobs:
       create-slvscode-ticket: ${{ github.event.inputs.ide-integration == 'true' }}
       branch: ${{ github.event.inputs.branch }}
       pm-email: "jean.jimbo@sonarsource.com"
-      slack-channel: "squad-jvm-releases"
+      slack-channel: "squad-corelang-releases"
       verbose: ${{ github.event.inputs.verbose == 'true' }}
       use-jira-sandbox: ${{ github.event.inputs.dry-run == 'true' }}
       is-draft-release: ${{ github.event.inputs.dry-run == 'true' }}

.github/workflows/dogfood.yml

@@ -41,5 +41,5 @@ jobs:
       env:
         SLACK_BOT_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SLACK_BOT_TOKEN }}
       with:
-        channel-id: squad-jvm-notifs
+        channel-id: squad-corelang-notifs
         slack-message: "Dogfood build for `${{ steps.dogfood.outputs.sha1 }}`: *failed*, see the logs at https://github.com/SonarSource/sonar-java/actions/workflows/dogfood.yml"

.github/workflows/release.yml

@@ -23,6 +23,6 @@ jobs:
     with:
       publishToBinaries: true
       mavenCentralSync: true
-      slackChannel: squad-jvm-releases
+      slackChannel: squad-corelang-releases
       version: ${{ inputs.version }}
       dryRun: ${{ inputs.dryRun == true }}

check-list/pom.xml

@@ -7,7 +7,7 @@
     <parent>
       <groupId>org.sonarsource.java</groupId>
       <artifactId>java</artifactId>
-      <version>8.34.0-SNAPSHOT</version>
+      <version>8.35.0-SNAPSHOT</version>
     </parent>
 
     <artifactId>check-list</artifactId>

docs/java-custom-rules-example/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>docs</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
 

docs/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>docs</artifactId>

external-reports/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>external-reports</artifactId>

its/autoscan/pom.xml

@@ -6,7 +6,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java-its</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>it-java-autoscan</artifactId>

its/autoscan/src/test/resources/autoscan/diffs/diff_S6813.json

@@ -1,6 +1,6 @@
 {
   "ruleKey": "S6813",
   "hasTruePositives": true,
-  "falseNegatives": 66,
+  "falseNegatives": 69,
   "falsePositives": 0
-}
+}

its/autoscan/src/test/resources/autoscan/diffs/diff_S6548.json → its/autoscan/src/test/resources/autoscan/diffs/diff_S8909.json

@@ -1,5 +1,5 @@
 {
-  "ruleKey": "S6548",
+  "ruleKey": "S8909",
   "hasTruePositives": true,
   "falseNegatives": 0,
   "falsePositives": 0

its/plugin/plugins/java-extension-plugin/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>it-java-plugin-plugins</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>java-extension-plugin</artifactId>

its/plugin/plugins/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>it-java-plugin</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>it-java-plugin-plugins</artifactId>

its/plugin/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java-its</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>it-java-plugin</artifactId>

its/plugin/tests/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>it-java-plugin</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>it-java-plugin-tests</artifactId>

its/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>java-its</artifactId>

its/ruling/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java-its</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>it-java-ruling</artifactId>

java-checks-aws/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>java-checks-aws</artifactId>

java-checks-common/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>java-checks-common</artifactId>

java-checks-test-sources/aws/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java-checks-test-sources</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>aws</artifactId>

java-checks-test-sources/default/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java-checks-test-sources</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>default</artifactId>

java-checks-test-sources/default/src/main/java/checks/quarkus/CacheKeyGeneratorInstantiableCheckSample.java

@@ -0,0 +1,193 @@
+package checks.quarkus;
+
+import io.quarkus.cache.CacheKeyGenerator;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.Dependent;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Inject;
+import java.lang.reflect.Method;
+
+class NoncompliantBasic implements CacheKeyGenerator { // Noncompliant {{Make this class a CDI bean by adding a scope annotation, or add a public no-args constructor.}}
+//    ^^^^^^^^^^^^^^^^^
+  private final ConfigService configService;
+
+  public NoncompliantBasic(ConfigService configService) {
+    this.configService = configService;
+  }
+
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return configService.getPrefix() + methodParams[0];
+  }
+}
+
+class NoncompliantMultipleDependencies implements CacheKeyGenerator { // Noncompliant
+//    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  private final DatabaseService dbService;
+  private final CacheConfig config;
+
+  public NoncompliantMultipleDependencies(DatabaseService dbService, CacheConfig config) {
+    this.dbService = dbService;
+    this.config = config;
+  }
+
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return dbService.format(methodParams[0]);
+  }
+}
+
+class NoncompliantMultipleConstructors implements CacheKeyGenerator { // Noncompliant
+//    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  private final String prefix;
+
+  public NoncompliantMultipleConstructors(String prefix) {
+    this.prefix = prefix;
+  }
+
+  public NoncompliantMultipleConstructors(String prefix, int timeout) {
+    this.prefix = prefix;
+  }
+
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return prefix + methodParams[0];
+  }
+}
+
+class NoncompliantPrivateConstructor implements CacheKeyGenerator { // Noncompliant
+//    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  private NoncompliantPrivateConstructor() {}
+
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return methodParams[0];
+  }
+}
+
+@ApplicationScoped
+class CompliantApplicationScoped implements CacheKeyGenerator {
+  @Inject
+  ConfigService configService;
+
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    String prefix = configService.getPrefix();
+    return prefix + methodParams[0];
+  }
+}
+
+@Dependent
+class CompliantDependent implements CacheKeyGenerator {
+  @Inject
+  ConfigService configService;
+
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return configService.getPrefix() + methodParams[0];
+  }
+}
+
+@RequestScoped
+class CompliantRequestScoped implements CacheKeyGenerator {
+  @Inject
+  ConfigService configService;
+
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return configService.getPrefix() + methodParams[0];
+  }
+}
+
+class NoncompliantPackagePrivateImplicitConstructor implements CacheKeyGenerator { // Noncompliant
+//    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return methodParams[0];
+  }
+}
+
+class CompliantExplicitNoArgsConstructor implements CacheKeyGenerator {
+  public CompliantExplicitNoArgsConstructor() {}
+
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return methodParams[0];
+  }
+}
+
+class CompliantMultipleConstructorsWithNoArgs implements CacheKeyGenerator {
+  private final String prefix;
+
+  public CompliantMultipleConstructorsWithNoArgs() {
+    this.prefix = "default";
+  }
+
+  public CompliantMultipleConstructorsWithNoArgs(String prefix) {
+    this.prefix = prefix;
+  }
+
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return prefix + methodParams[0];
+  }
+}
+
+@jakarta.enterprise.context.ApplicationScoped
+class CompliantFullyQualifiedJakartaAnnotation implements CacheKeyGenerator {
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return methodParams[0];
+  }
+}
+
+@javax.enterprise.context.ApplicationScoped
+class CompliantFullyQualifiedJavaxAnnotation implements CacheKeyGenerator {
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return methodParams[0];
+  }
+}
+
+abstract class CompliantAbstractClass implements CacheKeyGenerator {
+}
+
+interface CompliantInterface extends CacheKeyGenerator {
+}
+
+class AnonymousClassUser {
+  // Anonymous class implementing CacheKeyGenerator - covers isAnonymous check (line 72)
+  CacheKeyGenerator generator = new CacheKeyGenerator() {
+    @Override
+    public Object generate(Method method, Object... methodParams) {
+      return methodParams[0];
+    }
+  };
+}
+
+@jakarta.enterprise.context.SessionScoped
+class CompliantFullyQualifiedSessionScoped implements CacheKeyGenerator {
+  @Override
+  public Object generate(Method method, Object... methodParams) {
+    return methodParams[0];
+  }
+}
+
+class NotACacheKeyGenerator {
+  public NotACacheKeyGenerator(String param) {}
+}
+
+class ConfigService {
+  public String getPrefix() {
+    return "prefix";
+  }
+}
+
+class DatabaseService {
+  public String format(Object obj) {
+    return obj.toString();
+  }
+}
+
+class CacheConfig {
+}

java-checks-test-sources/default/src/main/java/io/quarkus/cache/CacheKeyGenerator.java

@@ -0,0 +1,10 @@
+package io.quarkus.cache;
+
+import java.lang.reflect.Method;
+
+/**
+ * Mock-up interface for Quarkus CacheKeyGenerator for testing purposes
+ */
+public interface CacheKeyGenerator {
+  Object generate(Method method, Object... methodParams);
+}

java-checks-test-sources/java-17/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.sonarsource.java</groupId>
     <artifactId>java-checks-test-sources</artifactId>
-    <version>8.34.0-SNAPSHOT</version>
+    <version>8.35.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>java-17</artifactId>