java - How to analyze code from other class than currently analyzed in SonarQube? -

case: i'm writing sonarqube rule needs check if manually created object being closed. when it's not, issue should raised.

let's assume part related determining if object created manually (or not) easy , not relevant. purpose of example it'll constructor call. however, there other ways instantiate kind of object, not eligible closing.

these cases cover. let's assume have following class:

public class mytype {     public void close() {         //close     } } 

this first case. simple one:

public class classone {      public void methoda() {         mytype z = null;         try {             z = new mytype();             // sth         } {             z.close(); // correct use         }     }      public void methodb() {         mytype z = new mytype();         // sth         // incorrect use, should closed here     } } 

second one, bit more tricky:

public class classone {      mytype creator() {         return new mytype();     }      mytype jump() {         return creator();     }      public void methoda() {         mytype z = null;         try {             z = jump();             // sth         } {             z.close(); // correct use         }     }      public void methodb() {         mytype z = jump();         // sth         // incorrect use, should closed here     } } 

third case, 1 i'm not able handle:

public class classone {      public void methoda() {         mytype z = null;         try {             z = new classtwo().creator();             // sth         } {             z.close(); // correct use         }     }      public void methodb() {         mytype z = new classtwo().creator();;         // sth         // incorrect use, should closed here     } }   public class classtwo {     mytype creator() {         return new mytype();     } } 

to sum up. implemented first , second case. have problem third one, since don't know how jump method declaration of other class analyze if creates object manually.

what correct way implement it? possible? (using available api of course)

both of analyzed classes belong same project , included project analysis.

short answer : available api can't solve third case.

now more detailed answer : how sonarqube java plugin runs analysis : works source file (aka compilationunit) source file , read bytecode symbols out of source resolve them even if source these symbols available analyzer. current limitation : sources analyzed in isolation 1 another.

this means that, of today, able know method called in source not have access code of method api if defined outside source.

there plans make limitation go away @ point not scheduled now.

there might workaround hacking around , complex (you can "inline" bytecode instructions or try read , parse source you're interested in) won't recommend those.