Solved sonar hotspots

[stijnpotters1]

Began with 43 hotspots

Now:

[Copilot]

Pull request overview

Resolves Sonar findings across shared clients, data import, web security, and tests.

Changes:

• Refactors exception handling, visibility, naming, and assertions.
• Encapsulates Trivy report results.
• Makes rate-limited paths configurable.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
insights-webapp/.../UserServiceIntegrationTest.java	Uses specialized count assertions.
insights-webapp/.../UserResponseDTOTest.java	Consolidates AssertJ assertions.
insights-webapp/.../GitHubOAuthAttributesTest.java	Improves null and equality assertions.
insights-webapp/.../RateLimitServiceTest.java	Uses specialized numeric assertions.
insights-webapp/.../RunCypressE2eTest.java	Logs health-check failures.
insights-webapp/.../RateLimitInterceptorTest.java	Supplies rate-limit configuration.
insights-webapp/.../TestSecurityConfig.java	Adapts interceptor construction and security setup.
insights-webapp/.../SecurityConfigIntegrationTest.java	Consolidates session assertions.
insights-webapp/src/main/resources/application.properties	Defines protected and exempt paths.
insights-webapp/.../UserService.java	Improves caught-exception handling.
insights-webapp/.../RateLimitProperties.java	Adds rate-limit configuration properties.
insights-webapp/.../RateLimitInterceptor.java	Uses configurable path matching.
insights-webapp/.../SecurityConfig.java	Updates security-chain signature.
insights-data-import/.../GitHubWebhookSecurityIntegrationTest.java	Strengthens webhook verification.
insights-data-import/.../GitHubWebhookControllerTest.java	Removes duplicated coverage.
insights-data-import/.../VulnerabilityScanServiceTest.java	Uses encapsulated report results.
insights-data-import/.../FileTreeDeleterTest.java	Uses an unnamed resource variable.
insights-data-import/.../GitHubGraphQLClientTest.java	Follows renamed client accessor.
insights-data-import/.../GitHubWebhookController.java	Narrows the parsing exception.
insights-data-import/.../VulnerabilityScanService.java	Uses report accessors.
insights-data-import/.../TrivyReport.java	Encapsulates JSON-mapped results.
insights-data-import/.../ReleaseArtifactService.java	Logs cleanup failures.
insights-data-import/.../SystemDataInitializer.java	Narrows injection-step exceptions.
insights-common/.../GraphQLClientTest.java	Follows renamed client accessor.
insights-common/.../ApiClientTest.java	Uses a no-exception assertion.
insights-common/.../RestClient.java	Restricts constructor visibility.
insights-common/.../GraphQLClient.java	Refines naming, generics, and visibility.
insights-common/.../ApiClient.java	Restricts constructor visibility.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 34 out of 35 changed files in this pull request and generated 3 comments.

Suppressed comments (3)

insights-webapp/src/test/java/org/frankframework/insights/common/configuration/TestSecurityConfig.java:23

• HttpSecurity.build() throws a checked Exception; without declaring or handling it, this test configuration does not compile. Restore the exception declaration.

    public SecurityFilterChain testSecurityFilterChain(HttpSecurity http) {

insights-webapp/src/main/java/org/frankframework/insights/common/configuration/SecurityConfig.java:49

• HttpSecurity.build() declares a checked Exception, so removing it from this bean method leaves the .build() call at line 92 unhandled and prevents the webapp module from compiling. Restore the declaration (or catch and translate the exception).

    public SecurityFilterChain securityFilterChain(HttpSecurity http, SessionRegistry sessionRegistry) {

insights-webapp/src/main/java/org/frankframework/insights/common/ratelimit/RateLimitInterceptor.java:84

• The configured protected paths are only evaluated after MVC selects this interceptor, but WebMvcConfiguration.java:19 still registers it solely for /api/auth/** and /api/business-value/**. Thus the newly configured /api/vulnerabilities path—and any other path added through this supposedly configurable list—never reaches this method and is not rate limited. Register the interceptor broadly and let isRateLimited filter requests, or derive registration patterns from these properties.

        return startsWithAny(requestURI, rateLimitProperties.getProtectedPaths())
                && !startsWithAny(requestURI, rateLimitProperties.getExemptPaths());

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud