New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Extend the FindOverridableMethodCall
detector to handle SER09-J
#2895
Conversation
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
|
spotbugs/src/main/java/edu/umd/cs/findbugs/detect/FindOverridableMethodCall.java
Outdated
Show resolved
Hide resolved
|
||
public class DirectReadObjectStreamMethods { | ||
|
||
private void readObject(final ObjectInputStream stream) throws IOException, ClassNotFoundException { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I tried it, the checking of the exceptional methods indirectly does work, there is no FP reported when these methods are called indirectly. Can you please add the testcase for it?
The readObject() method must not call any overridable methods. Invoking overridable methods from the readObject() method can provide the overriding method with access to the object's state before it is fully initialized. This premature access is possible because, in deserialization, readObject plays the role of object constructor and therefore object initialization is not complete until readObject exits.
Please read the SEI CERT rule SER09-J for details.
The rule is similar to MET06-J. Do not invoke overridable methods in clone()), which is detected by the
FindOverridableMethodCall
, hence the extension of the existing detector instead of introducing a new one with the same functionality.