SONARJAVA-6721 Implement S9141: Intrinsic locks should not be used on "java.util.concurrent" objects

[NoemieBenard]

---

Summary by Gitar

• New checks:
  • Implemented SynchronizedOnConcurrentObjectCheck (S9141) to detect synchronized blocks on java.util.concurrent objects
• Tests and documentation:
  • Added rule metadata, HTML documentation, JSON definition, test samples, and verifier tests for S9141

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-6721

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Implements rule S9141 to detect intrinsic locks used on java.util.concurrent objects, addressing the scope finding to correctly target all concurrent types. No issues found.

✅ 1 resolved

✅ Edge Case: Rule flags all java.util.concurrent types, not just sync primitives

📄 java-checks/src/main/java/org/sonar/java/checks/SynchronizedOnConcurrentObjectCheck.java:48-54
isFromConcurrentPackage matches any type whose FQN starts with java.util.concurrent., so synchronized on concurrent collections (e.g. ConcurrentHashMap, CopyOnWriteArrayList, ConcurrentLinkedQueue) or utility types (Future, TimeUnit, ThreadLocalRandom) is also reported. Externally locking such objects is occasionally a legitimate pattern, so this may produce false positives beyond the synchronization primitives the RSPEC emphasizes. If the intent is truly the whole package this is fine; otherwise consider restricting to the lock/semaphore/latch/barrier/queue subtypes and adding compliant test cases for concurrent collections to document the intended scope.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube