SONARJAVA-4698 Fix false positive in S1191 when variable is named "sun"

java-checks-test-sources/default/src/main/files/non-compiling/checks/SunPackagesUsedCheckSample.java

@@ -21,15 +21,15 @@ public Object uselessMethod() {
 
   // SONARJAVA-4698: False positive when variable is named "sun"
   public void fooWithFieldNamedSun() {
-    sun.toString(); // Compliant - FP: "sun" is a field of type Object, not a sun.* package class
+    sun.toString(); // Compliant - "sun" is a field of type Object, not a sun.* package class
   }
 
   public void barWithParameterNamedSun(Object sun) {
-    sun.toString(); // Compliant - FP: "sun" is a parameter of type Object, not a sun.* package class
+    sun.toString(); // Compliant - "sun" is a parameter of type Object, not a sun.* package class
   }
 
   public void bazWithLocalVariableNamedSun() {
     Object sun = new Object();
-    sun.toString(); // Compliant - FP: "sun" is a local variable of type Object, not a sun.* package class
+    sun.toString(); // Compliant - "sun" is a local variable of type Object, not a sun.* package class
   }
 }

java-checks-test-sources/default/src/main/java/checks/SunPackagesUsedCheckSample.java

@@ -0,0 +1,25 @@
+package checks;
+
+class SunPackagesUsedCheckSample {
+  private Object sun; // variable named "sun"
+
+  // SONARJAVA-4698: Variables named "sun" should not trigger the rule
+  public void fooWithFieldNamedSun() {
+    sun.toString(); // Compliant - "sun" is a field of type Object, not a sun.* package class
+  }
+
+  public void barWithParameterNamedSun(Object sun) {
+    sun.toString(); // Compliant - "sun" is a parameter of type Object, not a sun.* package class
+  }
+
+  public void bazWithLocalVariableNamedSun() {
+    Object sun = new Object();
+    sun.toString(); // Compliant - "sun" is a local variable of type Object, not a sun.* package class
+  }
+
+  // Actual sun.* package usage - should trigger the rule
+  public void useSunMiscUnsafe() {
+    sun.misc.Unsafe unsafe = null; // Noncompliant {{Use classes from the Java API instead of Sun classes.}}
+//  ^^^^^^^^^^^^^^^
+  }
+}

java-checks/src/main/java/org/sonar/java/checks/SunPackagesUsedCheck.java

@@ -79,13 +79,15 @@ private static boolean isActuallySunPackage(MemberSelectExpressionTree tree) {
     // Check if the expression's type actually comes from a sun.* package
     // This prevents false positives when a variable is named "sun"
     var type = tree.expression().symbolType();
-    if (type.isUnknown()) {
-      // If we can't determine the type, we should still check to avoid missing real issues
-      // In this case, rely on the string-based check
-      return true;
+    if (!type.isUnknown()) {
+      // When we have type information, use it to determine if it's actually a sun.* package
+      String fullyQualifiedName = type.fullyQualifiedName();
+      return fullyQualifiedName.startsWith("sun.");
     }
-    String fullyQualifiedName = type.fullyQualifiedName();
-    return fullyQualifiedName.startsWith("sun.");
+    // When type is unknown (non-compiling code), we can't use semantic analysis
+    // In this case, rely on the string-based check which has already been done
+    // This means we may miss some FPs in non-compiling code, but we'll catch them with proper semantic analysis
+    return true;
   }
 
   private boolean isExcluded(String reference) {

java-checks/src/test/java/org/sonar/java/checks/SunPackagesUsedCheckTest.java

@@ -40,4 +40,12 @@ void check_with_exclusion() {
       .verifyIssues();
   }
 
+  @Test
+  void detected_with_semantic() {
+    CheckVerifier.newVerifier()
+      .onFile(TestUtils.mainCodeSourcesPath("checks/SunPackagesUsedCheckSample.java"))
+      .withCheck(new SunPackagesUsedCheck())
+      .verifyIssues();
+  }
+
 }