SONARJAVA-3259 Implement new rule S5673 by romainbrenguier · Pull Request #5780 · SonarSource/sonar-java

romainbrenguier · 2026-07-13T11:06:04Z

This rule detects classes and interfaces annotated with @Component whose names suggest they should use specialized Spring stereotype annotations (@Service, @Repository, @Controller, or @RestController) instead.

The rule also covers interfaces, which is relevant for Spring Data repository interfaces — where Spring generates the implementation at runtime, but @Repository is still the appropriate stereotype.

hashicorp-vault-sonar-prod · 2026-07-13T11:06:18Z

SONARJAVA-3259

@service

This rule detects classes annotated with @component whose names suggest they should use specialized Spring stereotype annotations (@service, @repository, @controller, or @RestController) instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Fixed S1449 violations by adding Locale.ROOT to two toLowerCase() calls in SpringComponentSpecializationCheck.containsIgnoreCase() - Added missing autoscan diff files for new rule S5673 (hasTruePositives=false, falseNegatives=17, falsePositives=0) by creating diff_S5673.json and adding entry to autoscan-diff-by-rules.json - Fixed 2 S1449 code smells in SpringComponentSpecializationCheck.java: added Locale.ROOT to toLowerCase() calls in containsIgnoreCase method (already applied in commit df023db)

Replace containsIgnoreCase with endsWithIgnoreCase for the ServiceFacade suffix check, consistent with all other name-matching patterns in the rule. This avoids false positives on classes like ServiceFacadeBuilder or ServiceFacadeConfiguration. Remove the now-unused containsIgnoreCase helper.

gitar-bot · 2026-07-13T14:10:35Z

Code Review ✅ Approved 1 resolved / 1 findings

Implements rule S5673 to identify @Component classes that should use specialized Spring stereotypes, while addressing the inconsistent suffix matching for ServiceFacade.

✅ 1 resolved

✅ Edge Case: ServiceFacade matched with contains, inconsistent with other suffixes

📄 java-checks/src/main/java/org/sonar/java/checks/spring/SpringComponentSpecializationCheck.java:68-72 📄 java-checks/src/main/java/org/sonar/java/checks/spring/SpringComponentSpecializationCheck.java:90-92
Every other classification uses endsWithIgnoreCase, but the Service case additionally uses containsIgnoreCase(className, "ServiceFacade"). Because contains matches anywhere in the name, a class like ServiceFacadeBuilder or ServiceFacadeConfiguration (which is not itself a service) would be flagged and told to use @Service. This is broader than the suffix-based intent of the rule and can produce false positives.

Consider using a suffix check for consistency, e.g. endsWithIgnoreCase(className, "ServiceFacade"), so only classes ending in Facade (following the ...ServiceFacade naming) are flagged. If matching anywhere in the name is intentional, it should be applied consistently across all stereotypes and documented in the rule.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

rombirli

Very clear implementation

rombirli · 2026-07-14T10:22:20Z

+    String suggestedAnnotation = getSuggestedAnnotation(className);
+
+    if (suggestedAnnotation != null) {
+      reportIssue(componentAnnotation.get(), String.format("Use @%s instead of @Component", suggestedAnnotation));


Optional: The issue message could also suggest renaming the class as an alternative way to fix

rombirli · 2026-07-14T10:25:29Z

+
+  @Override
+  public List<Tree.Kind> nodesToVisit() {
+    return List.of(Tree.Kind.CLASS);


What about records, enums, interfaces, annotation_types? Just to double-check if it is intentional to not include them.

I don't think this would make sense for records enum and annotations. But for interfaces I think it does, in particular repositories can be just interfaces. Let me check.

@repository

Extend the rule to cover interface declarations in addition to classes. This is relevant for Spring Data repository interfaces annotated with @component, where @repository would be the appropriate stereotype.

sonarqube-next · 2026-07-14T13:10:53Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

gitar-bot · 2026-07-14T16:32:53Z

Code Review ✅ Approved 1 resolved / 1 findings

Implements rule S5673 to detect misplaced Spring stereotype annotations on classes and interfaces. The suffix matching logic for ServiceFacade was updated to be case-insensitive, resolving the identified inconsistency.

✅ 1 resolved

✅ Edge Case: ServiceFacade matched with contains, inconsistent with other suffixes

📄 java-checks/src/main/java/org/sonar/java/checks/spring/SpringComponentSpecializationCheck.java:68-72 📄 java-checks/src/main/java/org/sonar/java/checks/spring/SpringComponentSpecializationCheck.java:90-92
Every other classification uses endsWithIgnoreCase, but the Service case additionally uses containsIgnoreCase(className, "ServiceFacade"). Because contains matches anywhere in the name, a class like ServiceFacadeBuilder or ServiceFacadeConfiguration (which is not itself a service) would be flagged and told to use @Service. This is broader than the suffix-based intent of the rule and can produce false positives.

Consider using a suffix check for consistency, e.g. endsWithIgnoreCase(className, "ServiceFacade"), so only classes ending in Facade (following the ...ServiceFacade naming) are flagged. If matching anywhere in the name is intentional, it should be applied consistently across all stereotypes and documented in the rule.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

gitar-bot Bot reviewed Jul 13, 2026

View reviewed changes

Comment thread java-checks/src/main/java/org/sonar/java/checks/spring/SpringComponentSpecializationCheck.java

Implement new rule S5673

700dbe2

This rule detects classes annotated with @component whose names suggest they should use specialized Spring stereotype annotations (@service, @repository, @controller, or @RestController) instead.

romainbrenguier force-pushed the new-rule/SONARJAVA-3259-S5673 branch from 053660b to 700dbe2 Compare July 13, 2026 12:40

romainbrenguier and others added 2 commits July 13, 2026 15:01

Fix S1449: use Locale.ROOT in toLowerCase() calls

df023db

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

romainbrenguier requested a review from rombirli July 13, 2026 14:07

romainbrenguier marked this pull request as ready for review July 13, 2026 14:10

rombirli approved these changes Jul 14, 2026

View reviewed changes

romainbrenguier added 3 commits July 14, 2026 14:07

S5673: also apply to interfaces

1d30c80

Extend the rule to cover interface declarations in addition to classes. This is relevant for Spring Data repository interfaces annotated with @component, where @repository would be the appropriate stereotype.

S5673: suggest renaming as alternative fix in issue message

ffd168d

Update autoscan results

f102561

romainbrenguier merged commit 015d825 into master Jul 14, 2026
15 checks passed

romainbrenguier deleted the new-rule/SONARJAVA-3259-S5673 branch July 14, 2026 16:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

SONARJAVA-3259 Implement new rule S5673#5780

SONARJAVA-3259 Implement new rule S5673#5780
romainbrenguier merged 7 commits into
masterfrom
new-rule/SONARJAVA-3259-S5673

romainbrenguier commented Jul 13, 2026 •

edited

Loading

Uh oh!

hashicorp-vault-sonar-prod Bot commented Jul 13, 2026 •

edited by atlassian Bot

Loading

Uh oh!

Uh oh!

gitar-bot Bot commented Jul 13, 2026

Uh oh!

rombirli left a comment

Uh oh!

rombirli Jul 14, 2026

Uh oh!

rombirli Jul 14, 2026

Uh oh!

romainbrenguier Jul 14, 2026

Uh oh!

sonarqube-next Bot commented Jul 14, 2026

Uh oh!

Uh oh!

gitar-bot Bot commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

romainbrenguier commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hashicorp-vault-sonar-prod Bot commented Jul 13, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

gitar-bot Bot commented Jul 13, 2026

Uh oh!

rombirli left a comment

Choose a reason for hiding this comment

Uh oh!

rombirli Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

rombirli Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

romainbrenguier Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqube-next Bot commented Jul 14, 2026

Quality Gate passed

Uh oh!

Uh oh!

gitar-bot Bot commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

romainbrenguier commented Jul 13, 2026 •

edited

Loading

hashicorp-vault-sonar-prod Bot commented Jul 13, 2026 •

edited by atlassian Bot

Loading