SONARJAVA-6722 Implement S9142: Expensive compilation or preparation operations should not be performed inside loops by NoemieBenard · Pull Request #5893 · SonarSource/sonar-java

NoemieBenard · 2026-08-06T09:14:34Z

Summary by Gitar

New checks:
- Implemented CompilationOrPreparationInLoopCheck (S9142) to detect regex compilation and database preparation inside loops
- Added sample test sources and unit tests for S9142 rule verification
Rule metadata:
- Added rule definition and localization documentation for S9142

_{This will update automatically on new commits.}

hashicorp-vault-sonar-prod · 2026-08-06T09:14:51Z

SONARJAVA-6722

github-actions · 2026-08-06T09:27:49Z

❌ Ruling needs updating. A fix PR has been created: #5894

Please review and merge it into your branch.

github-actions · 2026-08-06T09:39:30Z

Ruling Diff Summary

Detected changes in 2 rule files: 0 issues removed, 11 issues added.

S9142 (java) on eclipse-jetty - 0 issues removed, 8 issues added - new ruling file

Added jetty-server/src/test/java/org/eclipse/jetty/server/MultiPartCaptureTest.java (line 220)

(source file not found at this revision: jetty-server/src/test/java/org/eclipse/jetty/server/MultiPartCaptureTest.java)

Added jetty-server/src/test/java/org/eclipse/jetty/server/handler/InetAccessHandlerTest.java (line 91)

(source file not found at this revision: jetty-server/src/test/java/org/eclipse/jetty/server/handler/InetAccessHandlerTest.java)

Added jetty-server/src/test/java/org/eclipse/jetty/server/handler/InetAccessHandlerTest.java (line 98)

(source file not found at this revision: jetty-server/src/test/java/org/eclipse/jetty/server/handler/InetAccessHandlerTest.java)

Added jetty-server/src/test/java/org/eclipse/jetty/server/handler/InetAccessHandlerTest.java (line 105)

(source file not found at this revision: jetty-server/src/test/java/org/eclipse/jetty/server/handler/InetAccessHandlerTest.java)

Added jetty-server/src/test/java/org/eclipse/jetty/server/handler/NcsaRequestLogTest.java (line 806)

(source file not found at this revision: jetty-server/src/test/java/org/eclipse/jetty/server/handler/NcsaRequestLogTest.java)

Added jetty-server/src/test/java/org/eclipse/jetty/server/handler/NcsaRequestLogTest.java (line 808)

(source file not found at this revision: jetty-server/src/test/java/org/eclipse/jetty/server/handler/NcsaRequestLogTest.java)

S9142 (java) on sonar-server - 0 issues removed, 3 issues added - new ruling file

Added src/main/java/org/sonar/server/source/DecorationDataHolder.java (line 48)

(source file not found at this revision: src/main/java/org/sonar/server/source/DecorationDataHolder.java)

Added src/main/java/org/sonar/server/source/DecorationDataHolder.java (line 60)

(source file not found at this revision: src/main/java/org/sonar/server/source/DecorationDataHolder.java)

Added src/main/java/org/sonar/server/source/DecorationDataHolder.java (line 73)

(source file not found at this revision: src/main/java/org/sonar/server/source/DecorationDataHolder.java)

sonarqube-next · 2026-08-06T09:47:35Z

Quality Gate failed

Failed conditions
86.1% Coverage on New Code (required ≥ 90%)

See analysis details on SonarQube

github-actions · 2026-08-06T09:53:20Z

❌ Ruling needs updating. A fix PR has been created: #5894

Please review and merge it into your branch.

Use a String-specific issue message, skip OpenJDK split fast-path and for-initializers, and require all Pattern.compile arguments to be loop-invariant.

gitar-bot · 2026-08-14T12:34:33Z

Code Review ✅ Approved 3 resolved / 3 findings

Implements rule S9142 to detect expensive compilation or preparation operations inside loops, addressing misleading regex messages, test coverage gaps, and loop-invariant false positives.

✅ 3 resolved

✅ Quality: Misleading message for String instance regex methods

📄 java-checks/src/main/java/org/sonar/java/checks/CompilationOrPreparationInLoopCheck.java:82-84
For String.matches/replaceAll/replaceFirst/split the message is "Move this "matches" call outside the loop.", but these are instance calls on the per-iteration loop variable and cannot simply be moved out — the correct remediation (per the rule HTML) is to precompile a Pattern once and reuse matcher() inside the loop. Consider a method-specific message advising precompilation for the String-regex matchers versus the Pattern.compile/prepareStatement cases.

✅ Edge Case: Missing test coverage for key edge cases

📄 java-checks-test-sources/default/src/main/java/checks/CompilationOrPreparationInLoopCheckSample.java:1-15
The sample omits several important scenarios: nested loops (invariant relative to inner loop), an argument that is a mutated field (this.field = ...), lambda/anonymous-class bodies inside the loop, and compound assignments (pattern += ...). Adding these would pin down the intended behavior and guard against the false positives described above.

✅ Edge Case: Invariance check misses field mutations, causing false positives

📄 java-checks/src/main/java/org/sonar/java/checks/CompilationOrPreparationInLoopCheck.java:87-101
isLoopInvariant decides invariance by matching variable names and only tracks assignments/increments whose target is(Tree.Kind.IDENTIFIER). A field reassigned inside the loop via a member select (this.field = ..., this.field++) or mutated through a method call is never added to names, so Pattern.compile(field) in the loop is wrongly flagged as loop-invariant. Prefer resolving the argument's Symbol (semantic model) and confirming it is a local variable/parameter that is not reassigned in the loop; at minimum handle MEMBER_SELECT assignment targets and treat fields conservatively (do not report).

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

sonarqube-next · 2026-08-14T12:42:40Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
90.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

nathsou · 2026-08-14T13:54:50Z

+    return false;
+  }
+
+  private static boolean isLoopInvariant(ExpressionTree arg, Tree loop) {


Checking for loop invariants sounds like something that would be nice to extract as a common helper, I checked and rule S6909 defines a very similar method:

sonar-java/java-checks/src/main/java/org/sonar/java/checks/PreparedStatementLoopInvariantCheck.java

Line 93 in c9f819a

private static boolean isLoopInvariant(Set<String> declaredOrAssignedLocals, Candidate candidate) {

but your new implementation is much more robust so it might be worth refactoring S6909 and share the method impl. (could be done in another PR as a refactoring or here if you prefer).

nathsou · 2026-08-14T14:00:09Z

+    return String.format("Move this \"%s\" call outside the loop.", ExpressionUtils.methodName(mit).name());
+  }
+
+  private static boolean isInForInitializer(Tree tree, Tree loop) {


FP found by an LLM:

The iterable expression in an enhanced for-loop (e.g. for (String s : text.split(";")) or for (String s : Pattern.compile(";").split(text))) is evaluated only once before the loop starts (JLS §14.14.2).

Because isInForInitializer only checks ForStatementTree.initializer(), calls inside ForEachStatement.expression() will be flagged as false positives.

NoemieBenard added 3 commits August 5, 2026 17:22

Add rule metadata

850fc56

Add failing reproducer

f5ef064

Implement rule

cee8cea

gitar-bot Bot reviewed Aug 6, 2026

View reviewed changes

Comment thread java-checks/src/main/java/org/sonar/java/checks/CompilationOrPreparationInLoopCheck.java

gitar-bot Bot reviewed Aug 6, 2026

View reviewed changes

Comment thread java-checks/src/main/java/org/sonar/java/checks/CompilationOrPreparationInLoopCheck.java Outdated

gitar-bot Bot reviewed Aug 6, 2026

View reviewed changes

Comment thread ...cks-test-sources/default/src/main/java/checks/CompilationOrPreparationInLoopCheckSample.java

github-actions Bot mentioned this pull request Aug 6, 2026

Update ruling results for PR #5893 #5894

Closed

Update ruling expectations

15b7b16

nathsou assigned nathsou and NoemieBenard Aug 13, 2026

nathsou and others added 6 commits August 14, 2026 08:36

Fix S9142 messages, split fast path, and loop-invariant false positives.

b82ea91

Use a String-specific issue message, skip OpenJDK split fast-path and for-initializers, and require all Pattern.compile arguments to be loop-invariant.

Address review comments and fix sonarqube issues

8771e5c

Update ruling expectations

c22a79d

Improve test coverage

9024910

Improve test coverage again

ba917e1

Improve test coverage

a3a2611

NoemieBenard force-pushed the nb/sonarjava-6722-implement-S9142 branch from 0765dd5 to a3a2611 Compare August 14, 2026 12:34

NoemieBenard marked this pull request as ready for review August 14, 2026 12:44

NoemieBenard requested a review from nathsou August 14, 2026 12:52

nathsou requested changes Aug 14, 2026

View reviewed changes

nathsou removed their assignment Aug 14, 2026

Navigation Menu

Uh oh!

SONARJAVA-6722 Implement S9142: Expensive compilation or preparation operations should not be performed inside loops - #5893

SONARJAVA-6722 Implement S9142: Expensive compilation or preparation operations should not be performed inside loops#5893
NoemieBenard wants to merge 10 commits into
masterfrom
nb/sonarjava-6722-implement-S9142

NoemieBenard commented Aug 6, 2026 •

edited by gitar-bot Bot

Loading

Uh oh!

hashicorp-vault-sonar-prod Bot commented Aug 6, 2026 •

edited by atlassian Bot

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

sonarqube-next Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

gitar-bot Bot commented Aug 14, 2026

Uh oh!

sonarqube-next Bot commented Aug 14, 2026

Uh oh!

nathsou Aug 14, 2026

Uh oh!

nathsou Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

NoemieBenard commented Aug 6, 2026 • edited by gitar-bot Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Gitar

Uh oh!

hashicorp-vault-sonar-prod Bot commented Aug 6, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Ruling Diff Summary

Uh oh!

sonarqube-next Bot commented Aug 6, 2026

Quality Gate failed

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

gitar-bot Bot commented Aug 14, 2026

Uh oh!

sonarqube-next Bot commented Aug 14, 2026

Quality Gate passed

Uh oh!

nathsou Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

nathsou Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

NoemieBenard commented Aug 6, 2026 •

edited by gitar-bot Bot

Loading

hashicorp-vault-sonar-prod Bot commented Aug 6, 2026 •

edited by atlassian Bot

Loading