[Luqmansonar]

Fixes two false positives from SONARJAVA-6383: constant ternaries and primitive operands. Not addressed: s + "" (needs symbolic execution). Replaces #6388, rebased on master after #6379.

[hashicorp-vault-sonar-prod]

SONARJAVA-6383

[Luqmansonar]

Thanks @asya-vorobeva, this replaces #6388 and is rebased on master after #6379 merged. I checked #6379 for code to reuse. It only adds private methods that count '?' placeholders, so there is no shared helper to extract. The ternary logic differs: you take the max of the branches, S2077 flags the query if either branch is dynamic. The primitive check is one line (isPrimitive || isPrimitiveWrapper), and char is handled differently: you allow for '?', S2077 keeps its existing behavior. A shared helper would need flags for these differences, so I kept the code local.

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Adjusting SQL injection analysis to treat primitive values and constant ternary branches as safe could suppress findings if these cases are misclassified.

Fixes two S2077 false positives in the Java analyzer: constant ternary expressions and primitive operands are no longer flagged. No issues found.

Verification Rules 2/2 met Repos 5 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 5 inspected

Cross-repo 5 repositories inspected 0 open impacts

SonarSource/sonarlint-vscode Inspected
SonarSource/sonarlint-intellij Inspected
SonarSource/sonarlint-language-server Inspected
SonarSource/sonar-java-symbolic-execution Inspected
SonarSource/sonar-lits Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}