WSO2 Code Specific Plugin

[areebniyas]

Purpose

In WSO2, we have a set of coding best practices and security best practices which are not common in Java. So using default or basic static analysis tools such as find bugs and check style will not be able to analyze and identify these types of bugs.

Goals

The goal is to help offload the PR review process for the leads.

Approach

With a custom sonar plugin, we will be able to write custom rules that can be used to detect common WSO2 specific violations and security guidelines. Developers can easily integrate Sonar into their workflow and ensure that their code adheres to WSO2’s coding standards before a code review session.

This PR includes a custom sonar plugin that includes various custom rules:

• Class Level Variables in Services - Custom check to see if class level variables exist in specific services and make sure the variables declared in specific services are static and final.

• Tenant Flow - Custom check to make sure TenantFlow() invocations are inside try/finally blocks. It covers all the cases from checking if endTenantFlow() is called in the finally block only and startTenantFlow() is in a try block and it is the first line in a try block.

• License Header - Custom check to see if Inc. exists in license header. Since we recently became LLC, this check will identity the use of WSO2 Inc anywhere in the codebase.

• Class Name - Custom check to see if class names contain the word 'Class' or 'Enum'.

• Variable Length - Custom check to see if variable name length exceeds 1.