Can SonarQube code duplication detector be parameterized to stop on method boundaries?

Question

I’m using SonarQube on my Java projects, and want to eliminate code duplications from our code as far as possible.

My problem is that SonarQube’s code duplication detection doesn’t take into account method boundaries. It lists identical parts of files as duplications, and it often happens that a duplication starts in the middle of a method and ends in the middle of another. These can hardly be refactored.

Here is an example. Click on file MavenArtifactRepository.java in the upper right list box, and take a look at the 4th duplication block in the lower part of the page.

Is there any way to parameterize the code duplication detector plug-in to show duplications, which are syntactically coherent?

Answer 1

Currently you cannot achieve that by configuring SonarQube itself. However, you can try our tool, SourceMeter with its SonarQube plug-in, which implements an AST based clone detection and therefore it presents syntactically coherent duplications inside SonarQube. For an example, you may take a look at the online demo.

Answer 2

The problem you mention is well-known in the clone-research community and one of the major issues why not many people use clone detection in practice. SonarQube implements a fairly simple and naive algorithm that detects code duplication based on sequences of tokens and has therefore no understanding of what a method is (besides a number of other problems). So the answer to your question is no.

One solution would be to look for a clone detection algorithm that detects code duplication based on abstract syntax trees (AST). But to the best of my knowledge there is no such tool available for free.

An alternative solution would be to use ConQAT. ConQAT uses a token-based clone detection approach as well, but has fairly sophisticated post-processing steps. One of these is the so-called "AST-alignment" where duplicated code fragments are aligned with the syntactic units (like methods) within the source code after detection. This should be exactly what you are looking for.