title: SonarQube rule: "Using command line arguments is security-sensitive" in Spring Boot application
body: <p>SonarQube is just showing a Critical security issue in the very basic Spring Boot application. In the main method.</p>
  
  <pre><code>@SpringBootApplication
  public class Application {
  
      public static void main(String[] args) {
          SpringApplication.run(Application.class, args);
      }
  
  }
  </code></pre>
  
  <p>SonarQube wants me to <code>Make sure that command line arguments are used safely here.</code></p>
  
  <p>I searched this on both StackOverflow and Google, and I am surprised that I couldn't find any single comment about this issue. I am almost sure that there are some security checks inside the <code>SpringApplication.run</code> method already. And also, I don't even remember that anyone sanitizes the main method arguments before calling <code>SpringApplication.run</code>. I simply want to tag it as <strong>false positive</strong> and move on.</p>
  
  <p>Part of this question is also asked here: <a href="https://stackoverflow.com/questions/54856544/sonarqube-shows-a-secuirty-error-in-spring-framework-controllers-and-in-spring-f">SonarQube shows a secuirty error in Spring Framework controllers and in Spring Framework Application main class</a></p>
  
  <p>Is it false positive?</p>