[sonarqube-agent-dev7]

This PR was automatically created by the Remediation Agent's Scheduled backlog remediation feature.

Why these issues? Prioritized MAJOR severity issues with clear, automatable fixes: removed the non-invariant loop counter assignment (S127), replaced System.out with Logger (S106), added @OverRide annotation (S1161), and replaced generic Exception with SQLException in method signatures (S112). All changes are well-scoped, low-risk, and address fundamental code quality violations across the security demo application.

This PR resolves 5 MAJOR SonarQube issues including removing a faulty loop counter assignment, replacing System.out with proper logging, adding missing @OverRide annotations, and replacing generic exceptions with specific SQLException declarations. These fixes improve code maintainability, correctness, and alignment with Java best practices.

View Project in SonarCloud

---

Fixed Issues

java:S127 - Refactor the code in order to not assign to this loop counter from within the loop body. • MAJOR • View issue

Location: src/main/java/demo/security/util/DBUtils.java:82

Why is this an issue?

A for loop termination condition should test the loop counter against an invariant value that does not change during the execution of the loop. Invariant termination conditions make the program logic easier to understand and maintain.

What changed

Removes the faulty inner for loop. Its header declared the counter m but tested and incremented the outer loop variable i, so the loop changed a counter the outer loop also controls. Because m never advanced, the loop added no real logic. Deleting it removes the non-invariant loop counter assignment the scanner flagged.

--- a/src/main/java/demo/security/util/DBUtils.java
+++ b/src/main/java/demo/security/util/DBUtils.java
@@ -82,6 +85,0 @@ public class DBUtils {
-                    for (int m = 2; i <= number / 2; i++) {
-                        if (number % m == 0) {
-                            count++;
-                            break;
-                        }
-                    }

java:S106 - Replace this use of System.out by a logger. • MAJOR • View issue

Location: src/main/java/demo/security/util/DBUtils.java:96

Why is this an issue?

In software development, logs serve as a record of events within an application, providing crucial insights for debugging. When logging, it is essential to ensure that the logs are:

What changed

Imports java.util.logging.Level and java.util.logging.Logger. The new logger field and the guarded logging call that replace the direct System.out output depend on these imports.

--- a/src/main/java/demo/security/util/DBUtils.java
+++ b/src/main/java/demo/security/util/DBUtils.java
@@ -9,0 +10,2 @@ import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;

java:S1161 - Add the "@OverRide" annotation above this method signature • MAJOR • View issue

Location: src/main/java/demo/security/servlet/HomeServlet.java:30

Why is this an issue?

While not mandatory, using the @Override annotation on compliant methods improves readability by making it explicit that methods are overridden.

What changed

The scanner flagged doPost(HttpServletRequest, HttpServletResponse) in HomeServlet because it overrides HttpServlet.doPost without saying so. This hunk adds the @OverRide annotation directly above that method. That makes the override explicit to readers. It also lets the compiler check that the method really overrides a parent method, so a signature typo would be caught at compile time.

--- a/src/main/java/demo/security/servlet/HomeServlet.java
+++ b/src/main/java/demo/security/servlet/HomeServlet.java
@@ -29,0 +30,1 @@ public class HomeServlet extends HttpServlet {
+    @Override

java:S112 - Replace generic exceptions with specific library exceptions or a custom exception. • MAJOR • View issue 1
java:S112 - Replace generic exceptions with specific library exceptions or a custom exception. • MAJOR • View issue 2

Location: src/main/java/demo/security/servlet/Insecure.java:35

Why is this an issue?

Throwing generic exceptions such as Error, RuntimeException, Throwable, and Exception will have a negative impact on any code trying to catch these exceptions.

What changed

Adds the java.sql.SQLException import. The two method signatures need it so they can declare this specific exception instead of the generic Exception.

--- a/src/main/java/demo/security/servlet/Insecure.java
+++ b/src/main/java/demo/security/servlet/Insecure.java
@@ -11,0 +12,1 @@ import java.sql.ResultSet;
+import java.sql.SQLException;

Have a suggestion or found an issue? Share your feedback here.

---

SonarQube Remediation Agent uses AI. Check for mistakes.

[sonarqube-agent-dev7]

⚠️ This repository does not have a CODEOWNERS file. The PR has been created but has not been automatically assigned to any reviewer. To ensure PRs are reviewed promptly, consider adding a CODEOWNERS file to your repository.

[sonarqube-cloud-dev7]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud