SONARPY-5082: Implement rule S9460 - Sole starred generator arguments should be parenthesized

GitOrigin-RevId: 596802420b12a43260ecba56181834ecefb82d85

Author: joke1196

python-checks/src/main/java/org/sonar/python/checks/OpenSourceCheckList.java

@@ -240,6 +240,9 @@ public Stream<Class<?>> getChecks() {
       DisabledHtmlAutoEscapeLegacyCheck.class,
       DisabledRDSEncryptionCheck.class,
       DisabledSNSTopicEncryptionCheck.class,
+      DjangoModelFormFieldsCheck.class,
+      DjangoModelStringFieldCheck.class,
+      DjangoModelStrMethodCheck.class,
       DjangoNonDictSerializationCheck.class,
       DjangoRenderContextCheck.class,
       DoublePrefixOperatorCheck.class,
@@ -323,6 +326,7 @@ public Stream<Class<?>> getChecks() {
       IdentityComparisonWithCachedTypesCheck.class,
       IdentityComparisonWithNewObjectCheck.class,
       IgnoredPureOperationsCheck.class,
+      ImplicitlySkippedTestCheck.class,
       ImplicitStringConcatenationCheck.class,
       ImpossibleBackReferenceCheck.class,
       ImpossibleBoundariesCheck.class,
@@ -340,6 +344,7 @@ public Stream<Class<?>> getChecks() {
       InstanceAndClassMethodsAtLeastOnePositionalCheck.class,
       InstanceMethodSelfAsFirstCheck.class,
       InputInAsyncCheck.class,
+      IntentionalTestFailureMessageCheck.class,
       InvalidOpenModeCheck.class,
       InvalidRegexCheck.class,
       InvariantReturnCheck.class,
@@ -368,6 +373,7 @@ public Stream<Class<?>> getChecks() {
       MethodNameCheck.class,
       MethodShouldBeStaticCheck.class,
       MissingDocstringCheck.class,
+      MissingHyperParameterCheck.class,
       MissingNewlineAtEndOfFileCheck.class,
       MisspelledMockAssertionCheck.class,
       MockPatchLambdaReturnValueCheck.class,
@@ -383,6 +389,7 @@ public Stream<Class<?>> getChecks() {
       NestedControlFlowDepthCheck.class,
       NestedLoopVariableReuseCheck.class,
       NestedWithStatementsCheck.class,
+      NetworkCallsWithoutTimeoutsInLambdaCheck.class,
       NewStyleClassCheck.class,
       NonCallableCalledCheck.class,
       NonContextManagerCheck.class,
@@ -395,7 +402,6 @@ public Stream<Class<?>> getChecks() {
       NoReRaiseInExitCheck.class,
       NoSonarCommentCheck.class,
       NoSonarCommentFormatCheck.class,
-      TemplateAndStrConcatenationCheck.class,
       NotDiscoverableTestMethodCheck.class,
       NotImplementedBooleanContextCheck.class,
       NotImplementedErrorInOperatorMethodsCheck.class,
@@ -415,14 +421,14 @@ public Stream<Class<?>> getChecks() {
       PandasReadNoDataTypeCheck.class,
       PandasToDatetimeFormatCheck.class,
       ParsingErrorCheck.class,
+      PossessiveQuantifierContinuationCheck.class,
       PredictableSaltCheck.class,
       PreIncrementDecrementCheck.class,
       PrintStatementUsageCheck.class,
       PrivilegePolicyCheck.class,
       ProcessSignallingCheck.class,
       PropertyAccessorParameterCountCheck.class,
       PropertyMethodWithoutReturnCheck.class,
-      PytzUsageCheck.class,
       PseudoRandomCheck.class,
       PublicApiIsSecuritySensitiveCheck.class,
       PubliclyWritableDirectoriesCheck.class,
@@ -449,17 +455,21 @@ public Stream<Class<?>> getChecks() {
       PytestUselessYieldFixtureCheck.class,
       PyTorchDataLoaderNumWorkersCheck.class,
       PytzTimeZoneInDatetimeConstructorCheck.class,
+      PytzUsageCheck.class,
       RaiseOutsideExceptCheck.class,
       RandomSeedCheck.class,
       RedosCheck.class,
       RedundantJumpCheck.class,
-      PossessiveQuantifierContinuationCheck.class,
       RedundantRegexAlternativesCheck.class,
+      ReferencedBeforeAssignmentCheck.class,
+      RegexComplexityCheck.class,
+      RegexLookaheadCheck.class,
       ReluctantQuantifierCheck.class,
       ReluctantQuantifierWithEmptyContinuationCheck.class,
       ResourceAccessPolicyCheck.class,
       ReturnAndYieldInOneFunctionCheck.class,
       ReturnYieldOutsideFunctionCheck.class,
+      RewriteCollectionConstructorAsComprehensionCheck.class,
       RobustCipherAlgorithmCheck.class,
       RouterPrefixInIncludeRouterCheck.class,
       S3BucketBlockPublicAccessCheck.class,
@@ -485,15 +495,18 @@ public Stream<Class<?>> getChecks() {
       SingleInvocationRuntimeExceptionCheck.class,
       SingleInvocationWarningCheck.class,
       SkippedTestNoReasonCheck.class,
+      SklearnCachedPipelineDontAccessTransformersCheck.class,
       SkLearnEstimatorDontInitializeEstimatedValuesCheck.class,
+      SklearnPipelineSpecifyMemoryArgumentCheck.class,
+      SklearnPipelineParameterAreCorrectCheck.class,
       SleepZeroInAsyncCheck.class,
-      SortedMinMaxCheck.class,
       SlotsAssignmentCheck.class,
+      SortedMinMaxCheck.class,
+      SoleStarredGeneratorArgumentCheck.class,
       SpecialMethodParamListCheck.class,
       SpecialMethodReturnTypeCheck.class,
       SpecificExceptionAssertionCheck.class,
       SpecificWarningAssertionCheck.class,
-      TestCasesShouldContainTestsCheck.class,
       SQLQueriesCheck.class,
       StartsWithEndsWithTupleCheck.class,
       StopIterationInGeneratorCheck.class,
@@ -504,22 +517,17 @@ public Stream<Class<?>> getChecks() {
       StringReplaceCheck.class,
       StrongCryptographicKeysCheck.class,
       SumListConcatenationCheck.class,
-      SklearnCachedPipelineDontAccessTransformersCheck.class,
-      MissingHyperParameterCheck.class,
-      NetworkCallsWithoutTimeoutsInLambdaCheck.class,
-      SklearnPipelineSpecifyMemoryArgumentCheck.class,
-      SklearnPipelineParameterAreCorrectCheck.class,
       SuperfluousCurlyBraceCheck.class,
       SuperLinearRegexCheck.class,
       SynchronousFileOperationsInAsyncCheck.class,
       SynchronousHttpOperationsInAsyncCheck.class,
       SynchronousSubprocessOperationsInAsyncCheck.class,
       SynchronousOsCallsInAsyncCheck.class,
-      TempFileCreationCheck.class,
-      ImplicitlySkippedTestCheck.class,
-      IntentionalTestFailureMessageCheck.class,
       TaskGroupNurseryUsedOnlyOnceCheck.class,
+      TempFileCreationCheck.class,
+      TemplateAndStrConcatenationCheck.class,
       TemplateStringStructuralPatternMatchingCheck.class,
+      TestCasesShouldContainTestsCheck.class,
       TestClientContentParameterCheck.class,
       TimeSleepInAsyncCheck.class,
       ToDoCommentCheck.class,
@@ -541,10 +549,6 @@ public Stream<Class<?>> getChecks() {
       TfInputShapeOnModelSubclassCheck.class,
       TfGatherDeprecatedValidateIndicesCheck.class,
       TfPyTorchSpecifyReductionAxisCheck.class,
-      ReferencedBeforeAssignmentCheck.class,
-      RegexComplexityCheck.class,
-      RegexLookaheadCheck.class,
-      RewriteCollectionConstructorAsComprehensionCheck.class,
       UnconditionalAssertionCheck.class,
       UseCachedPropertyCheck.class,
       UseMonkeypatchFixtureCheck.class,
@@ -593,10 +597,7 @@ public Stream<Class<?>> getChecks() {
       XMLParserXXEVulnerableCheck.class,
       XMLSignatureValidationCheck.class,
       YieldFromDelegationCheck.class,
-      DjangoModelFormFieldsCheck.class,
       WebEntryPointDecoratorCheck.class,
-      DjangoModelStringFieldCheck.class,
-      DjangoModelStrMethodCheck.class,
       HardcodedCredentialsCallCheck.class);
   }
 }

python-checks/src/main/java/org/sonar/python/checks/SoleStarredGeneratorArgumentCheck.java

@@ -0,0 +1,51 @@
+/*
+ * SonarQube Python Plugin
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonar.python.checks;
+
+import org.sonar.check.Rule;
+import org.sonar.plugins.python.api.PythonSubscriptionCheck;
+import org.sonar.plugins.python.api.SubscriptionContext;
+import org.sonar.plugins.python.api.quickfix.PythonQuickFix;
+import org.sonar.plugins.python.api.tree.ComprehensionExpression;
+import org.sonar.plugins.python.api.tree.RegularArgument;
+import org.sonar.plugins.python.api.tree.Tree;
+import org.sonar.python.quickfix.TextEditUtils;
+
+@Rule(key = "S9460")
+public class SoleStarredGeneratorArgumentCheck extends PythonSubscriptionCheck {
+
+  private static final String MESSAGE = "Add parentheses around this starred generator argument.";
+
+  @Override
+  public void initialize(Context context) {
+    context.registerSyntaxNodeConsumer(Tree.Kind.GENERATOR_EXPR, SoleStarredGeneratorArgumentCheck::checkGeneratorExpression);
+  }
+
+  private static void checkGeneratorExpression(SubscriptionContext ctx) {
+    ComprehensionExpression generatorExpression = (ComprehensionExpression) ctx.syntaxNode();
+    if (generatorExpression.parent() instanceof RegularArgument
+      && generatorExpression.resultExpression().is(Tree.Kind.UNPACKING_EXPR)
+      && !"(".equals(generatorExpression.firstToken().value())) {
+      var issue = ctx.addIssue(generatorExpression, MESSAGE);
+      var quickFix = PythonQuickFix.newQuickFix(MESSAGE)
+        .addTextEdit(TextEditUtils.insertBefore(generatorExpression.firstToken(), "("))
+        .addTextEdit(TextEditUtils.insertAfter(generatorExpression.lastToken(), ")"))
+        .build();
+      issue.addQuickFix(quickFix);
+    }
+  }
+}

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S9460.html

@@ -0,0 +1,34 @@
+<p>This rule raises an issue when a call has one unparenthesized flattened generator argument, such as a call that passes generated values without
+enclosing the generator expression in parentheses.</p>
+<p>This syntax represents one generator argument. It can be mistaken for positional argument unpacking.</p>
+<h2>Why is this an issue?</h2>
+<p>Recent versions of the language allow an iterable-expansion expression as the element of a generator expression. In a call written with a leading
+expansion marker immediately before a generator expression, the call receives one generator that produces the flattened elements. It does not expand
+that generator into several positional arguments.</p>
+<p>Without parentheses, this meaning is difficult to see. A reader may interpret the leading expansion marker as call-site argument unpacking,
+especially because expanding an iterable directly into a function call is a common pattern.</p>
+<p>Add parentheses to show the intended operation. Parenthesize the generator expression to pass one flattened generator argument. Use an additional
+expansion marker outside those parentheses when the generator itself must be unpacked into positional arguments.</p>
+<h3>What is the potential impact?</h3>
+<p>Ambiguous call syntax can lead to incorrect reviews, maintenance mistakes, or changes that alter how arguments are passed. Explicit parentheses
+make the call’s argument-passing behavior easier to understand.</p>
+<h2>How to fix it</h2>
+<p>Review the intended argument-passing behavior. If the function should receive one flattened generator as its only argument, add parentheses around
+the generator. A report is a false positive only if the analyzer incorrectly identified the source as this sole, unparenthesized starred-generator
+form, or if the configured Python version does not support this syntax. If the unparenthesized form is intentional and has been reviewed, keeping it
+is an acceptable won’t-fix decision, although parentheses make the intent clearer.</p>
+<h3>Code examples</h3>
+<h4>Noncompliant code example</h4>
+<pre data-diff-id="1" data-diff-type="noncompliant">
+result = f(*x for x in groups)  # Noncompliant
+</pre>
+<h4>Compliant solution</h4>
+<pre data-diff-id="1" data-diff-type="compliant">
+result = f((*x for x in groups))
+</pre>
+<h2>Resources</h2>
+<h3>Documentation</h3>
+<ul>
+  <li>PEP - <a href="https://peps.python.org/pep-0798/">PEP 798 – Unpacking in Comprehensions</a></li>
+</ul>
+

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S9460.json

@@ -0,0 +1,23 @@
+{
+  "title": "Sole starred generator arguments should be parenthesized",
+  "type": "CODE_SMELL",
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "5 min"
+  },
+  "tags": [
+    "python3.15"
+  ],
+  "defaultSeverity": "Major",
+  "ruleSpecification": "RSPEC-9460",
+  "sqKey": "S9460",
+  "scope": "All",
+  "quickfix": "unknown",
+  "code": {
+    "impacts": {
+      "MAINTAINABILITY": "MEDIUM"
+    },
+    "attribute": "CLEAR"
+  }
+}

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/Sonar_way_profile.json

@@ -406,6 +406,7 @@
     "S9409",
     "S9453",
     "S9454",
-    "S9455"
+    "S9455",
+    "S9460"
   ]
 }

python-checks/src/test/java/org/sonar/python/checks/SoleStarredGeneratorArgumentCheckTest.java

@@ -0,0 +1,48 @@
+/*
+ * SonarQube Python Plugin
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonar.python.checks;
+
+
+import org.junit.jupiter.api.Test;
+import org.sonar.python.checks.quickfix.PythonQuickFixVerifier;
+import org.sonar.python.checks.utils.PythonCheckVerifier;
+
+class SoleStarredGeneratorArgumentCheckTest {
+
+  private static final SoleStarredGeneratorArgumentCheck check = new SoleStarredGeneratorArgumentCheck();
+
+  @Test
+  void test() {
+    PythonCheckVerifier.verify("src/test/resources/checks/soleStarredGeneratorArgument.py", check);
+  }
+
+  @Test
+  void quickFix() {
+    PythonQuickFixVerifier.verify(check, "f(*x for x in groups)", "f((*x for x in groups))");
+  }
+
+  @Test
+  void multilineQuickFix() {
+    PythonQuickFixVerifier.verify(check, """
+      f(
+        *x for x in groups
+      )""", """
+      f(
+        (*x for x in groups)
+      )""");
+  }
+}

python-checks/src/test/resources/checks/soleStarredGeneratorArgument.py

@@ -0,0 +1,31 @@
+def f(*args):
+    pass
+
+
+def noncompliant(groups):
+    f(*x for x in groups)  # Noncompliant {{Add parentheses around this starred generator argument.}}
+    # ^^^^^^^^^^^^^^^^^^
+    obj.m(*x for x in groups)  # Noncompliant {{Add parentheses around this starred generator argument.}}
+    #     ^^^^^^^^^^^^^^^^^^
+
+
+async def noncompliant_async(groups):
+    f(*x async for x in groups)  # Noncompliant {{Add parentheses around this starred generator argument.}}
+    # ^^^^^^^^^^^^^^^^^^^^^^^^
+
+
+@f(*x for x in groups)  # Noncompliant {{Add parentheses around this starred generator argument.}}
+#  ^^^^^^^^^^^^^^^^^^
+def decorated():
+    pass
+
+
+def compliant(groups, values):
+    f((*x for x in groups))
+    f(*values)
+    f(*(x for x in groups))
+    f(*(x async for x in groups))
+    f(x for x in groups)
+    f(*(*x for x in groups))
+    [*x for x in groups]
+    a = (*x for x in groups)