[Luqmansonar]

Fixes two false-positive cases from SONARJAVA-6383:

• Concatenation with a ternary whose branches are all non-dynamic (e.g. "... " + (asc ? "ASC" : "DESC")) is no longer reported.
• Primitive and primitive-wrapper operands (e.g. " OFFSET " + offset) are no longer reported, consistent with the existing String.format handling.

Not addressed: s + "" (needs symbolic execution per the ticket).

Behavior change: SQLInjection.java line 190 (int id + " > query_id ") is now compliant instead of noncompliant. Ruling expectations may change; CI will propose updates.

🤖 Generated with Claude Code

[hashicorp-vault-sonar-prod]

SONARJAVA-6383

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · The SQL injection rule now treats primitive operands and constant ternaries as safe, so misclassification could suppress warnings for injectable query construction.

Reduces S2077 false positives in SQL string concatenation by skipping ternaries whose branches are all non-dynamic and primitive or primitive-wrapper operands like " OFFSET " + offset, consistent with existing String.format handling. No issues found.

Verification Rules 2/2 met Repos 5 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 5 inspected

Cross-repo 5 repositories inspected 0 open impacts

SonarSource/sonarlint-intellij Inspected
SonarSource/sonarlint-vscode Inspected
SonarSource/sonarlint-language-server Inspected
SonarSource/sonar-java-symbolic-execution Inspected
SonarSource/sonarqube Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[asya-vorobeva]

Hi! Please take a look at my recent PR #6379 which does almost the same checks for another rule. I think it makes sense to wait for my PR to be merged and after it extract / reuse common functionality.