SONARJAVA-6053 Fix S112 false positive for checked exception wrappers

[sonar-nigel]

Relates to SONARJAVA-6053

Suppress S112 when RuntimeException or Error is used in a catch block to wrap a specific checked exception as the cause, while keeping existing reports for broad generic throws and wrappers that do not preserve the caught cause.

• Keeps throws clause reporting unchanged.
• Requires the catch type to be a specific checked exception, including each multi-catch alternative.
• Accepts direct caught causes and causes derived through getCause() or getTargetException().

[sonar-nigel]

Rule Profile

Field	Value
Rule	S112 — Generic exceptions should never be thrown
Severity / type	Major CODE_SMELL
Sonar Way	Yes
Scope	Main

throw new Error("internal error");

False Positive Pattern

The false positives happen when code catches a specific checked exception and converts it to an unchecked wrapper because the enclosing API cannot or should not declare that checked exception. In that pattern, the generic wrapper type is intentional and the caught exception is preserved as the cause, so consumers still have the original failure context.

try {
    return invokeAsync(prompt).get();
}
catch (InterruptedException | ExecutionException e) {
    throw new RuntimeException(e);
}

False Negative Risk

The suppression is intentionally narrow: it only applies to RuntimeException and Error constructors inside a catch block, only when all caught alternatives are specific checked exceptions, and only when a constructor argument is the caught exception or a cause derived from it through getCause() or getTargetException(). Generic Exception/Throwable catches, unchecked catches, message-only wrappers, unrelated causes, and throws clause declarations continue to be reported, so the FN risk is bounded to deliberate checked-to-unchecked wrapping patterns.

Fix Summary

The implementation adds a catch-context check before reporting constructed raw exceptions. It recognizes preserved checked causes while leaving the rule's existing broad-exception behavior intact.

• Limits the exception to RuntimeException and Error wrappers.
• Validates catch parameter types as specific checked exceptions, including multi-catch.
• Supports direct caught exceptions and effectively-final locals initialized from getCause() or getTargetException().

[hashicorp-vault-sonar-prod]

SONARJAVA-6053

[sonarqube-next]

Quality Gate failed

Failed conditions
68.6% Coverage on New Code (required ≥ 90%)

See analysis details on SonarQube

[github-actions]

This PR is stale because it has been open 7 days with no activity. If there is no activity in the next 7 days it will be closed automatically