SONARJAVA-6976 Clear check state after file analysis

AGENTS.md

@@ -125,6 +125,41 @@ JavaQuickFix quickFix = JavaQuickFix.newQuickFix("Remove redundant check")
 reportIssue(tree, "Message").withQuickFix(() -> quickFix);
 ```
 
+### Per-File State Cleanup
+
+Rules that accumulate state in collections or mutable fields during file analysis **must clear that state between files**. A single rule instance is reused across all files in a module.
+
+For `IssuableSubscriptionVisitor` subclasses, override `clearState()` — it is called automatically before and after each file:
+
+```java
+@Rule(key = "S1234")
+public class MyCheck extends IssuableSubscriptionVisitor {
+
+  private final Set<Symbol> seen = new HashSet<>();
+
+  @Override
+  protected void clearState() {
+    seen.clear();
+  }
+}
+```
+
+For `BaseTreeVisitor` / `JavaFileScanner` implementations, clear state in `scanFile()` (typically in a `finally` block):
+
+```java
+@Override
+public void scanFile(JavaFileScannerContext context) {
+  this.context = context;
+  try {
+    scan(context.getTree());
+  } finally {
+    myCollection.clear();
+  }
+}
+```
+
+**Do not** clear lazy-initialized caches derived from immutable configuration (e.g. parsed `@RuleProperty` values) — those are intentionally computed once per rule instance.
+
 ### Dependency-Aware Rules
 
 When a rule should only apply when a specific library is present, or when its behaviour depends on a dependency version, implement `DependencyVersionAware` alongside the visitor base class:

java-checks/pom.xml

@@ -83,6 +83,12 @@
       <artifactId>junit-jupiter</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>com.tngtech.archunit</groupId>
+      <artifactId>archunit-junit5</artifactId>
+      <version>1.5.0</version>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>

java-checks/src/main/java/org/sonar/java/checks/AbstractInSynchronizeChecker.java

@@ -40,6 +40,7 @@ public void setContext(JavaFileScannerContext context) {
   @Override
   public void leaveFile(JavaFileScannerContext context) {
     withinSynchronizedBlock.clear();
+    super.leaveFile(context);
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/AccessibilityChangeOnRecordsCheck.java

@@ -108,4 +108,10 @@ private static Optional<Symbol> getIdentifierSymbol(MethodInvocationTree mit) {
     IdentifierTree identifier = (IdentifierTree) callee;
     return Optional.of(identifier.symbol());
   }
+  @Override
+  protected void clearState() {
+    primaryTargets.clear();
+    secondaryTargets.clear();
+  }
+
 }

java-checks/src/main/java/org/sonar/java/checks/BoxedBooleanExpressionsCheck.java

@@ -88,6 +88,9 @@ public class BoxedBooleanExpressionsCheck extends BaseTreeVisitor implements Jav
 
   @Override
   public void scanFile(JavaFileScannerContext context) {
+    ifStatementCache.clear();
+    firstNullCheckCache.clear();
+    safeSymbols.clear();
     this.context = context;
     try {
       if (context.getSemanticModel() != null) {

java-checks/src/main/java/org/sonar/java/checks/CatchUsesExceptionWithContextCheck.java

@@ -106,16 +106,19 @@ public class CatchUsesExceptionWithContextCheck extends BaseTreeVisitor implemen
   private Deque<UsageStatus> usageStatusStack;
   private Set<String> exceptions;
   private Set<String> exceptionIdentifiers;
-  private Set<CatchTree> excludedCatchTrees = new HashSet<>();
+  private final Set<CatchTree> excludedCatchTrees = new HashSet<>();
 
   @Override
   public void scanFile(JavaFileScannerContext context) {
     this.context = context;
     usageStatusStack = new ArrayDeque<>();
-    if (context.getSemanticModel() != null) {
-      scan(context.getTree());
+    try {
+      if (context.getSemanticModel() != null) {
+        scan(context.getTree());
+      }
+    } finally {
+      excludedCatchTrees.clear();
     }
-    excludedCatchTrees.clear();
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/ClassVariableVisibilityCheck.java

@@ -43,7 +43,12 @@ public class ClassVariableVisibilityCheck extends BaseTreeVisitor implements Jav
   @Override
   public void scanFile(JavaFileScannerContext context) {
     this.context = context;
-    scan(context.getTree());
+    isClassStack.clear();
+    try {
+      scan(context.getTree());
+    } finally {
+      isClassStack.clear();
+    }
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/DateEnumsCheck.java

@@ -165,8 +165,7 @@ public class DateEnumsCheck extends AbstractMethodDetection implements JavaVersi
   private final Map<InputFile, List<CachedIssue>> issuesByFile = new HashMap<>();
 
   @Override
-  public void setContext(JavaFileScannerContext context) {
-    super.setContext(context);
+  protected void clearState() {
     importSupplier = null;
     currentFileTotalUsageCount = 0;
     currentFileNoEnumUsageCount = 0;
@@ -175,7 +174,6 @@ public void setContext(JavaFileScannerContext context) {
 
   @Override
   public void leaveFile(JavaFileScannerContext context) {
-    importSupplier = null;
     CachedFileData restored = restoredFiles.remove(context.getInputFile());
     if (restored != null) {
       projectTotalUsageCount -= restored.totalCount();
@@ -200,9 +198,7 @@ public void leaveFile(JavaFileScannerContext context) {
       }
     }
 
-    currentFileTotalUsageCount = 0;
-    currentFileNoEnumUsageCount = 0;
-    currentFileIssues.clear();
+    super.leaveFile(context);
   }
 
   @Override
@@ -354,6 +350,7 @@ public void endOfAnalysis(ModuleScannerContext context) {
     }
     projectTotalUsageCount = 0;
     projectTotalNoEnumUsageCount = 0;
+    currentFileIssues.clear();
     issuesByFile.clear();
     restoredFiles.clear();
   }

java-checks/src/main/java/org/sonar/java/checks/HardcodedURICheck.java

@@ -93,8 +93,7 @@ private record VariableData(Symbol symbol, String identifier, ExpressionTree ini
   private final List<VariableData> hardCodedUri = new ArrayList<>();
 
   @Override
-  public void setContext(JavaFileScannerContext context) {
-    super.setContext(context);
+  protected void clearState() {
     annotationsStack.clear();
     identifiersUsedInAnnotations.clear();
     hardCodedUri.clear();
@@ -116,7 +115,8 @@ public void leaveFile(JavaFileScannerContext context) {
       }
     }
 
-    for (VariableData v : hardCodedUri) {
+    try {
+      for (VariableData v : hardCodedUri) {
       // equals to an identifier with unknown semantic, we cannot compare their symbols
       if (idNamesWithoutSemantic.contains(v.identifier())) {
         continue;
@@ -128,6 +128,9 @@ public void leaveFile(JavaFileScannerContext context) {
         continue;
       }
       reportHardcodedURI(v.initializer());
+      }
+    } finally {
+      super.leaveFile(context);
     }
   }
 

java-checks/src/main/java/org/sonar/java/checks/IndentationCheck.java

@@ -67,7 +67,11 @@ public void scanFile(JavaFileScannerContext context) {
     excludeIssueAtLine = 0;
     this.context = context;
     fileLines = context.getFileLines();
-    scan(context.getTree());
+    try {
+      scan(context.getTree());
+    } finally {
+      fileLines = null;
+    }
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/InnerStaticClassesCheck.java

@@ -44,7 +44,14 @@ public class InnerStaticClassesCheck extends BaseTreeVisitor implements JavaFile
   @Override
   public void scanFile(final JavaFileScannerContext context) {
     this.context = context;
-    scan(context.getTree());
+    outerClasses.clear();
+    atLeastOneReference.clear();
+    try {
+      scan(context.getTree());
+    } finally {
+      outerClasses.clear();
+      atLeastOneReference.clear();
+    }
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/LazyArgEvaluationCheck.java

@@ -136,10 +136,15 @@ private static String[] testMethodNames(String[] lowerCaseNames) {
   @Override
   public void scanFile(JavaFileScannerContext context) {
     this.context = context;
-    if (context.getSemanticModel() == null) {
-      return;
+    treeStack.clear();
+    try {
+      if (context.getSemanticModel() == null) {
+        return;
+      }
+      scan(context.getTree());
+    } finally {
+      treeStack.clear();
     }
-    scan(context.getTree());
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/MissingPackageInfoCheck.java

@@ -51,5 +51,7 @@ public void endOfAnalysis(ModuleScannerContext context) {
     for (String missingPackageInfo : missingPackageWithoutPackageFile) {
       context.addIssueOnProject(this, "Add a 'package-info.java' file to document the '" + missingPackageInfo + "' package");
     }
+    missingPackageWithoutPackageFile.clear();
+    knownPackageWithPackageFile.clear();
   }
 }

java-checks/src/main/java/org/sonar/java/checks/MutableMembersUsageCheck.java

@@ -313,10 +313,17 @@ private void addMethodReturningPrivateMutable(String methodSignature, Identifier
 
   @Override
   public void scanFile(final JavaFileScannerContext context) {
-    scan(context.getTree());
-    dataPropagationGraph.reportMutableStoreReachableByOutsideCall(context, this);
-    dataPropagationGraph.reportMutableFieldReachingToOutside(context, this);
-    dataPropagationGraph.clear();
+    parametersStack.clear();
+    methodSignatureStack.clear();
+    try {
+      scan(context.getTree());
+      dataPropagationGraph.reportMutableStoreReachableByOutsideCall(context, this);
+      dataPropagationGraph.reportMutableFieldReachingToOutside(context, this);
+    } finally {
+      parametersStack.clear();
+      methodSignatureStack.clear();
+      dataPropagationGraph.clear();
+    }
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/NestedIfStatementsCheck.java

@@ -53,7 +53,11 @@ public class NestedIfStatementsCheck extends BaseTreeVisitor implements JavaFile
   public void scanFile(final JavaFileScannerContext context) {
     this.context = context;
     this.nestingLevel = new ArrayDeque<>();
-    scan(context.getTree());
+    try {
+      scan(context.getTree());
+    } finally {
+      nestingLevel.clear();
+    }
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/OperatorPrecedenceCheck.java

@@ -105,8 +105,13 @@ private static void put(Iterable<Tree.Kind> firstSet, Iterable<Tree.Kind> second
   public void scanFile(JavaFileScannerContext context) {
     this.context = context;
     reportedLines.clear();
-    scan(context.getTree());
-    reportedLines.clear();
+    stack.clear();
+    try {
+      scan(context.getTree());
+    } finally {
+      stack.clear();
+      reportedLines.clear();
+    }
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/RawExceptionCheck.java

@@ -64,7 +64,12 @@ public class RawExceptionCheck extends BaseTreeVisitor implements JavaFileScanne
   public void scanFile(JavaFileScannerContext context) {
     this.context = (FluentReporting) context;
     this.javaVersion = context.getJavaVersion();
-    scan(context.getTree());
+    exceptionsThrownByMethodInvocations.clear();
+    try {
+      scan(context.getTree());
+    } finally {
+      exceptionsThrownByMethodInvocations.clear();
+    }
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/RedundantTypeCastCheck.java

@@ -15,7 +15,6 @@
  * along with this program; if not, see https://sonarsource.com/license/ssal/
  */
 package org.sonar.java.checks;
-
 import java.util.Arrays;
 import java.util.List;
 import org.sonar.check.Rule;
@@ -111,4 +110,9 @@ private static boolean matchesWarning(JWarning warning, TypeCastTree tree) {
     return tree.equals(warningTree);
   }
 
+  @Override
+  protected void clearState() {
+    warnings = null;
+  }
+
 }

java-checks/src/main/java/org/sonar/java/checks/SelfAssignmentCheck.java

@@ -15,7 +15,6 @@
  * along with this program; if not, see https://sonarsource.com/license/ssal/
  */
 package org.sonar.java.checks;
-
 import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
@@ -139,4 +138,9 @@ private void updateWarnings(AssignmentExpressionTree tree) {
     warnings.removeIf(warning -> tree.equals(warning.syntaxTree()));
   }
 
+  @Override
+  protected void clearState() {
+    warnings.clear();
+  }
+
 }

java-checks/src/main/java/org/sonar/java/checks/ServletMethodsExceptionsThrownCheck.java

@@ -15,7 +15,6 @@
  * along with this program; if not, see https://sonarsource.com/license/ssal/
  */
 package org.sonar.java.checks;
-
 import java.util.ArrayDeque;
 import java.util.Arrays;
 import java.util.Collections;
@@ -144,4 +143,10 @@ private boolean isNotCaught(Type type) {
       .noneMatch(type::isSubtypeOf);
   }
 
+  @Override
+  protected void clearState() {
+    shouldCheck.clear();
+    tryCatches.clear();
+  }
+
 }

java-checks/src/main/java/org/sonar/java/checks/SeveralBreakOrContinuePerLoopCheck.java

@@ -47,7 +47,14 @@ public class SeveralBreakOrContinuePerLoopCheck extends BaseTreeVisitor implemen
   public void scanFile(JavaFileScannerContext context) {
     this.context = context;
     loopCount = 0;
-    scan(context.getTree());
+    breakAndContinueCounter.clear();
+    currentScopeIsSwitch.clear();
+    try {
+      scan(context.getTree());
+    } finally {
+      breakAndContinueCounter.clear();
+      currentScopeIsSwitch.clear();
+    }
   }
 
   @Override

java-checks/src/main/java/org/sonar/java/checks/ShiftOnIntOrLongCheck.java

@@ -57,8 +57,12 @@ public void setContext(JavaFileScannerContext context) {
 
   @Override
   public void leaveFile(JavaFileScannerContext context) {
-    for (int i = 0; i < shiftTrees.size(); i++) {
-      checkShiftTree(shiftTrees.get(i), i);
+    try {
+      for (int i = 0; i < shiftTrees.size(); i++) {
+        checkShiftTree(shiftTrees.get(i), i);
+      }
+    } finally {
+      shiftTrees.clear();
     }
   }