Add S2209/S3252 recipe: Static members via class name (#836)

* Add S2209/S3252 recipe: Static members should be accessed via class name

Implements OpenRewrite recipe to replace static field/method access through instance references with access via the declaring class name. Transforms instance.staticField to ClassName.staticField and instance.staticMethod() to ClassName.staticMethod(). Covers both RSPEC-S2209 (MAJOR) and RSPEC-S3252 rules.

* Fix nested class handling and chained side-effect detection

Handle nested class names (e.g. Outer.Inner) by building a J.FieldAccess
chain instead of using getClassName() as a single identifier. Add recursive
side-effect check for chained field access to avoid dropping method calls
in chains like getObj().field.STATIC.

* Reuse JavaElementFactory.className() for class reference building

Replace hand-rolled nested class handling with the existing utility,
which correctly handles type attribution, parameterized types, and
local classes.

* Add inner class and anonymous class tests for StaticAccessViaInstance

Author: timtebeek

src/main/java/org/openrewrite/staticanalysis/StaticAccessViaInstance.java

@@ -0,0 +1,122 @@
+/*
+ * Copyright 2026 the original author or authors.
+ * <p>
+ * Licensed under the Moderne Source Available License (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * https://docs.moderne.io/licensing/moderne-source-available-license
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.openrewrite.staticanalysis;
+
+import lombok.EqualsAndHashCode;
+import lombok.Value;
+import org.openrewrite.ExecutionContext;
+import org.openrewrite.Preconditions;
+import org.openrewrite.Recipe;
+import org.openrewrite.TreeVisitor;
+import org.openrewrite.java.JavaIsoVisitor;
+import org.openrewrite.java.tree.Expression;
+import org.openrewrite.java.tree.Flag;
+import org.openrewrite.java.tree.J;
+import org.openrewrite.java.tree.JavaType;
+import org.openrewrite.java.tree.TypeUtils;
+import org.openrewrite.staticanalysis.java.JavaFileChecker;
+
+import java.time.Duration;
+import java.util.Arrays;
+import java.util.LinkedHashSet;
+import java.util.Set;
+
+@Value
+@EqualsAndHashCode(callSuper = false)
+public class StaticAccessViaInstance extends Recipe {
+
+    String displayName = "Static members should be accessed via the class name";
+    String description = "Accessing static fields or calling static methods on an instance reference is misleading. " +
+            "Static members should be accessed using the declaring class name instead.";
+    Set<String> tags = new LinkedHashSet<>(Arrays.asList("RSPEC-S2209", "RSPEC-S3252"));
+    Duration estimatedEffortPerOccurrence = Duration.ofMinutes(2);
+
+    @Override
+    public TreeVisitor<?, ExecutionContext> getVisitor() {
+        return Preconditions.check(new JavaFileChecker<>(), new JavaIsoVisitor<ExecutionContext>() {
+
+            @Override
+            public J.FieldAccess visitFieldAccess(J.FieldAccess fieldAccess, ExecutionContext ctx) {
+                J.FieldAccess fa = super.visitFieldAccess(fieldAccess, ctx);
+                JavaType.Variable fieldType = fa.getName().getFieldType();
+                if (fieldType == null || !fieldType.hasFlags(Flag.Static)) {
+                    return fa;
+                }
+                Expression select = fa.getTarget();
+                if (!isInstanceAccess(select)) {
+                    return fa;
+                }
+                JavaType.FullyQualified declaringType = TypeUtils.asFullyQualified(fieldType.getOwner());
+                if (declaringType == null) {
+                    return fa;
+                }
+                maybeAddImport(declaringType.getFullyQualifiedName());
+                return fa.withTarget(buildClassReference(select, declaringType));
+            }
+
+            @Override
+            public J.MethodInvocation visitMethodInvocation(J.MethodInvocation method, ExecutionContext ctx) {
+                J.MethodInvocation mi = super.visitMethodInvocation(method, ctx);
+                JavaType.Method methodType = mi.getMethodType();
+                if (methodType == null || !methodType.hasFlags(Flag.Static)) {
+                    return mi;
+                }
+                Expression select = mi.getSelect();
+                if (select == null || !isInstanceAccess(select)) {
+                    return mi;
+                }
+                JavaType.FullyQualified declaringType = TypeUtils.asFullyQualified(methodType.getDeclaringType());
+                if (declaringType == null) {
+                    return mi;
+                }
+                maybeAddImport(declaringType.getFullyQualifiedName());
+                return mi.withSelect(buildClassReference(select, declaringType));
+            }
+
+            private boolean isInstanceAccess(Expression select) {
+                if (select instanceof J.Identifier) {
+                    J.Identifier ident = (J.Identifier) select;
+                    if ("this".equals(ident.getSimpleName()) || "super".equals(ident.getSimpleName())) {
+                        return true;
+                    }
+                    return ident.getFieldType() != null;
+                }
+                if (select instanceof J.FieldAccess) {
+                    J.FieldAccess fa = (J.FieldAccess) select;
+                    // Only safe when the entire chain is side-effect-free
+                    return fa.getName().getFieldType() != null && isSideEffectFree(fa.getTarget());
+                }
+                // Skip method invocations, new expressions, etc. to preserve side effects
+                return false;
+            }
+
+            private boolean isSideEffectFree(Expression expr) {
+                if (expr instanceof J.Identifier) {
+                    return true;
+                }
+                if (expr instanceof J.FieldAccess) {
+                    return isSideEffectFree(((J.FieldAccess) expr).getTarget());
+                }
+                return false;
+            }
+
+            private Expression buildClassReference(Expression select, JavaType.FullyQualified declaringType) {
+                return JavaElementFactory.className(declaringType, false)
+                        .withPrefix(select.getPrefix());
+            }
+        });
+    }
+}

src/main/resources/META-INF/rewrite/recipes.csv

@@ -140,6 +140,7 @@ maven,org.openrewrite.recipe:rewrite-static-analysis,org.openrewrite.staticanaly
 maven,org.openrewrite.recipe:rewrite-static-analysis,org.openrewrite.staticanalysis.ReplaceWeekYearWithYear,Week Year (YYYY) should not be used for date formatting,"For most dates Week Year (YYYY) and Year (yyyy) yield the same results. However, on the last week of December and the first week of January, Week Year could produce unexpected results. This is a common source of off-by-one-year bugs that typically only manifest around New Year's Eve, making them difficult to catch during development and testing.",1,,Static analysis and remediation,,Remediations for issues identified by SAST tools.,
 maven,org.openrewrite.recipe:rewrite-static-analysis,org.openrewrite.staticanalysis.SillyEqualsCheck,Silly equality checks should not be made,Detects `.equals()` calls that compare incompatible types and will always return `false`. Replaces `.equals(null)` with `== null` and array `.equals()` with `Arrays.equals()`. Flags comparisons between unrelated types or between arrays and non-arrays.,1,,Static analysis and remediation,,Remediations for issues identified by SAST tools.,
 maven,org.openrewrite.recipe:rewrite-static-analysis,org.openrewrite.staticanalysis.SimplifyArraysAsList,Simplify `Arrays.asList(..)` with varargs,"Simplifies `Arrays.asList()` method calls that use explicit array creation to use varargs instead. For example, `Arrays.asList(new String[]{""a"", ""b"", ""c""})` becomes `Arrays.asList(""a"", ""b"", ""c"")`. Explicitly constructing an array to pass to a varargs parameter adds visual clutter without changing behavior, since the compiler generates the array automatically.",1,,Static analysis and remediation,,Remediations for issues identified by SAST tools.,
+maven,org.openrewrite.recipe:rewrite-static-analysis,org.openrewrite.staticanalysis.StaticAccessViaInstance,Static members should be accessed via the class name,Accessing static fields or calling static methods on an instance reference is misleading. Static members should be accessed using the declaring class name instead.,1,,Static analysis and remediation,,Remediations for issues identified by SAST tools.,
 maven,org.openrewrite.recipe:rewrite-static-analysis,org.openrewrite.staticanalysis.SimplifyBooleanExpression,Simplify boolean expression,"Checks for overly complicated boolean expressions, such as `if (b == true)`, `b || true`, `!false`, etc. Needlessly complex boolean logic makes code harder to reason about and increases the chance of introducing errors during future modifications.",1,,Static analysis and remediation,,Remediations for issues identified by SAST tools.,
 maven,org.openrewrite.recipe:rewrite-static-analysis,org.openrewrite.staticanalysis.SimplifyBooleanExpressionWithDeMorgan,Simplify boolean expressions using De Morgan's laws,"Applies De Morgan's laws to simplify boolean expressions with negation. Transforms `!(a && b)` to `!a || !b` and `!(a || b)` to `!a && !b`. Distributing negations inward eliminates the outer `!` and makes each individual condition's polarity immediately visible, which aids comprehension.",1,,Static analysis and remediation,,Remediations for issues identified by SAST tools.,
 maven,org.openrewrite.recipe:rewrite-static-analysis,org.openrewrite.staticanalysis.SimplifyBooleanReturn,Simplify boolean return,"Simplifies Boolean expressions by removing redundancies. For example, `a && true` simplifies to `a`. Wrapping a boolean expression in an if-then-else just to return `true` or `false` adds unnecessary control flow that obscures the straightforward intent of the expression.",1,,Static analysis and remediation,,Remediations for issues identified by SAST tools.,