SONARJAVA-7163 Restrict S9436 to main code and report uninitialized loggers

[rombirli]

Summary

• Scope S9436 to main code, matching S1312 and S3416. Tests that keep one logger per class under test, to capture their output, are not the duplication this rule describes.
• The check now reports an uninitialized logger field too. The merged specification had already dropped that exception, and the implementation was still skipping those fields.
• Metadata is regenerated from rspec#8366.
• One new ruling finding, in ContextHandler.java. It is a true positive against the current specification: a production class with a static logger and a second, uninitialized logger field.

Test plan

• S9436.json has "scope": "Main"
• MoreThanOneLoggerCheckTest passes, including an uninitialized logger next to another one
• Ruling QA is green with the new expectation

[hashicorp-vault-sonar-prod]

SONARJAVA-7163

[rombirli]

Check now reports uninitialized logger fields, so the description matches it.

[github-actions]

⚖️ Ruling update ready for review: #6370

[github-actions]

Ruling Diff Summary

Detected changes in 2 rule files: 0 issues removed, 2 issues added.

S9436 (java) on eclipse-jetty - 0 issues removed, 1 issues added - new ruling file

Added jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java (line 207)

(source file not found at this revision: jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java)

S9436 (java) on eclipse-jetty-similar-to-main - 0 issues removed, 1 issues added - new ruling file

Added jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java (line 207)

(source file not found at this revision: jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java)

[github-actions]

⚖️ Ruling update ready for review: #6371

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · S9436 now ignores test code and flags uninitialized logger fields in production, which could add findings for configurable loggers and prompt unnecessary cleanup.

Restricts rule S9436 to main code so tests that keep one logger per class for output capture are no longer flagged, matching S1312 and S3416. The metadata now drops the uninitialized non-final logger exception, so those fields are reported and the description matches the behavior.

✅ 1 closed

✅ Bug: Doc drops the uninitialized non-final logger exception the check keeps

📄 sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S9436.html:19-22
The regenerated S9436.html deletes the paragraph saying that a non-final logger field with no initializer does not count. The check still applies that rule: MoreThanOneLoggerCheck.isDeclaredLogger only counts a field when field.initializer() != null || field.symbol().isFinal() (MoreThanOneLoggerCheck.java:85-87), and the PR description says "The check is unchanged". So the rule description no longer matches what the rule does. A user reading it would expect an issue for an injected private Logger log; setter-property next to a static logger, and none is raised.

The deletion also leaves wording that no longer makes sense. The next paragraph says the derived-name logger "does not count either", but the paragraph right before it is now the non-static one, which says the field does raise an issue. Either restore the paragraph in rspec#8366 and regenerate the metadata, or, if dropping the exception was intended, change isDeclaredLogger and its tests so they match the doc.

Verification Rules 1/1 met Repos 4 inspected · PRs 1 inspected

Functional validation No results

Rules 1 passed 2 not applicable

✅ Repository license compliance

Broader impact Repos 4 inspected PRs 1 inspected

Cross-repo 4 repositories inspected 0 open impacts

SonarSource/sonarlint-vscode Inspected
SonarSource/sonarlint-language-server Inspected
SonarSource/sonar-lits Inspected
SonarSource/sonarqube Inspected

Cross-PR 1 PR inspected 0 open impacts

PR #5627: SONARJAVA-6392 - Modify S8694: do not raise in tests Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[rombirli]

/pvf

[hashicorp-vault-sonar-prod]

⚠️ Performance Validation finished without publishing a dashboard. See run logs.

[romainbrenguier]

[nit] the PR title and description don't mention this change to the rule implementation

[rombirli]

Updated the title and description to mention the check change.