SONARJAVA-6777: Implement S9401: IdentityHashMap keys should not be boxed primitive types

[nathsou]

Summary

• Implement S9401 for IdentityHashMap constructors and Guava Maps.newIdentityHashMap().
• Detect all eight boxed primitive wrapper key types.
• Add focused semantic and no-bytecode tests.
• Generate rule metadata and activate the rule in Sonar way.

Links

• Jira: https://sonarsource.atlassian.net/browse/SONARJAVA-6777
• RSPEC PR: https://github.com/SonarSource/rspec/pull/8188

AI disclosure

• LLM model used for implementation: GPT-5.6 Sol Low

[hashicorp-vault-sonar-prod]

SONARJAVA-6777

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

Implements S9401 to detect boxed primitive types used as keys in IdentityHashMap and Guava's Maps.newIdentityHashMap(), covering all eight wrapper types with focused semantic and no-bytecode tests. Resolved Guava classpath duplication by aligning test setup with existing patterns and corrected issue messaging to align with the rule description.

✅ 2 closed

✅ Quality: test_guava puts two Guava versions on analysis classpath

📄 java-checks/src/test/java/org/sonar/java/checks/IdentityHashMapBoxedKeyCheckTest.java:19-22 📄 java-checks/src/test/java/org/sonar/java/checks/IdentityHashMapBoxedKeyCheckTest.java:50-58
java-checks-test-sources/default already declares Guava (32.1.1-jre, provided scope), so TestClasspathUtils.DEFAULT_MODULE.getClassPath() alone resolves com.google.common.collect.Maps — this is how the existing Guava sample test works (BigDecimalEqualsCheckTest.test_guava uses no custom classpath). Appending Maps.class's code source here adds the java-checks test-scoped Guava (33.7.1-jre per the root pom dependencyManagement) on top of 32.1.1-jre, so ECJ analyses the sample against two Guava jars and silently resolves whichever comes first; the test only passes because both versions still declare newIdentityHashMap(). Drop the manual classpath (and the Guava import/URISyntaxException) to match the established pattern.

✅ Quality: Issue message advises a fix the rule description does not recommend

📄 java-checks/src/main/java/org/sonar/java/checks/IdentityHashMapBoxedKeyCheck.java:33 📄 sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S9401.html:7-19
The reported message tells the developer to "Use a non-boxed key type", but the rule description's remediation and its compliant example fix the defect by changing the map implementation (new HashMap<>() with the same Integer key). Since map keys can never be primitives, a user acting on the message alone is pointed away from the documented fix; align the message with the description, e.g. mention using a map that compares keys by value (the sample's {{...}} assertion on line 20 of IdentityHashMapBoxedKeyCheckSample.java must be updated too).

Review coverage

Functional validation 1 of 1 objectives covered

Rules No rules evaluated

Auto-approval Not enabled · Set up

Implementation Status ✅ 1 of 1 objectives covered

✅ SONARJAVA-6777 - 1 of 1 objectives covered

This PR implements the S9401 rule to check that IdentityHashMap keys are not boxed primitive types.

✅ 1 covered here

• ✅ Implement S9401 rule to check that IdentityHashMap keys are not boxed primitive types

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube