SONARJAVA-6758: Fix FPs in S5673 for controllers without mappings and redundant annotations

[romainbrenguier]

Summary

• Controllers without mapping: Before suggesting @Controller or @RestController, the rule now verifies the class has at least one method with a request mapping annotation (@RequestMapping, @GetMapping, @PostMapping, @PutMapping, @DeleteMapping, @PatchMapping). Classes named "Controller" that don't handle HTTP requests no longer trigger the rule.
• Non-web framework exclusions: Classes implementing ApplicationRunner, CommandLineRunner, HealthIndicator, or ReactiveHealthIndicator, or annotated with @Endpoint, @RestControllerEndpoint, or @ControllerEndpoint are excluded from Controller/RestController suggestions.
• Redundant annotations: If a class already has a specialized stereotype annotation (@Controller, @RestController, @Service, @Repository) alongside @Component, the rule no longer raises.

Test plan

• Updated test sample with noncompliant Controller/RestController cases that include request mapping methods
• Added compliant cases for controllers without request mapping methods
• Added compliant cases for controllers implementing non-web framework interfaces (ApplicationRunner, CommandLineRunner)
• Added compliant cases for redundant stereotype annotations
• All Spring-related tests pass (45 tests)

🤖 Generated with Claude Code

[hashicorp-vault-sonar-prod]

SONARJAVA-6758

[nathsou]

RSPEC is now inconsistent with the analyzer

The ticket also asks to improve S5673 RSPEC (it was judged not actionable). There is no RSPEC PR, and the published examples are now wrong.

rules/S5673/java/rule.adoc still shows an empty FooBarRestController as noncompliant. After this change that class would not raise, which is why the unit test had to add @GetMapping to keep it noncompliant.

Please open a sibling RSPEC PR that:

• puts a mapping method on the Controller/RestController noncompliant example
• documents the new exceptions (no mapping methods, already-specialized stereotypes, actuator/startup types)
• aligns the issue message with the implementation (“or rename this type if @Component is intentional”)

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
96.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Refines rule S5673 to check for request mapping methods, exclude non-web framework classes, and handle redundant stereotype annotations, addressing the class-level @RequestMapping detection finding. No issues found.

✅ 1 resolved

✅ Edge Case: Class-level @RequestMapping not detected as a mapping method

📄 java-checks/src/main/java/org/sonar/java/checks/spring/SpringComponentSpecializationCheck.java:101-112
hasRequestMappingMethod only inspects method-level annotations, so a controller that declares its request mapping at the class level (e.g. @component @RequestMapping("/api") with handler methods that carry no mapping annotation, or methods inherited from a base class) will no longer be flagged. This trades the fixed FPs for potential false negatives on legitimate controllers. Consider also checking for a class-level @RequestMapping / mapping annotation before concluding the class handles no HTTP requests.

Implementation Status 🟡 0 / 1 issues implemented

⬜ SONARJAVA-6758 — 0 / 3 objectives

The PR diff is empty and does not implement any of the objectives.

• ⬜ Check if a specialized stereotype is already present and skip raising redundant annotations in S5673
• ⬜ Verify that a class has at least one request mapping annotation before suggesting @Controller in S5673
• ⬜ Exclude classes implementing framework interfaces or annotations that legitimately require @Component (such as HealthIndicator, @Endpoint, ApplicationRunner) from S5673

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}