diff --git a/src/test/resources/sanity_check_expected_issues.json b/src/test/resources/sanity_check_expected_issues.json index ffc582f..3832c2d 100644 --- a/src/test/resources/sanity_check_expected_issues.json +++ b/src/test/resources/sanity_check_expected_issues.json @@ -5,7 +5,7 @@ "severity": "major", "description": "Provide the parametrized type for this generic.", "content": { - "body": "

Generic types shouldn't be used raw (without type parameters) in variable declarations or return values. Doing so bypasses generic type checking,\nand defers the catch of unsafe code to runtime.

\n

Noncompliant Code Example

\n
\nList myList; // Noncompliant\nSet mySet; // Noncompliant\n
\n

Compliant Solution

\n
\nList<String> myList;\nSet<? extends Number> mySet;\n
" + "body": "\u003cp\u003eGeneric types shouldn\u0027t be used raw (without type parameters) in variable declarations or return values. Doing so bypasses generic type checking,\nand defers the catch of unsafe code to runtime.\u003c/p\u003e\n\u003ch2\u003eNoncompliant Code Example\u003c/h2\u003e\n\u003cpre\u003e\nList myList; // Noncompliant\nSet mySet; // Noncompliant\n\u003c/pre\u003e\n\u003ch2\u003eCompliant Solution\u003c/h2\u003e\n\u003cpre\u003e\nList\u0026lt;String\u0026gt; myList;\nSet\u0026lt;? extends Number\u0026gt; mySet;\n\u003c/pre\u003e" }, "location": { "path": "main/java/Library.java", @@ -24,7 +24,7 @@ "severity": "major", "description": "Provide the parametrized type for this generic.", "content": { - "body": "

Generic types shouldn't be used raw (without type parameters) in variable declarations or return values. Doing so bypasses generic type checking,\nand defers the catch of unsafe code to runtime.

\n

Noncompliant Code Example

\n
\nList myList; // Noncompliant\nSet mySet; // Noncompliant\n
\n

Compliant Solution

\n
\nList<String> myList;\nSet<? extends Number> mySet;\n
" + "body": "\u003cp\u003eGeneric types shouldn\u0027t be used raw (without type parameters) in variable declarations or return values. Doing so bypasses generic type checking,\nand defers the catch of unsafe code to runtime.\u003c/p\u003e\n\u003ch2\u003eNoncompliant Code Example\u003c/h2\u003e\n\u003cpre\u003e\nList myList; // Noncompliant\nSet mySet; // Noncompliant\n\u003c/pre\u003e\n\u003ch2\u003eCompliant Solution\u003c/h2\u003e\n\u003cpre\u003e\nList\u0026lt;String\u0026gt; myList;\nSet\u0026lt;? extends Number\u0026gt; mySet;\n\u003c/pre\u003e" }, "location": { "path": "main/java/Library.java", @@ -43,7 +43,7 @@ "severity": "minor", "description": "Move this file to a named package.", "content": { - "body": "

According to the Java Language Specification:

\n
\n

Unnamed packages are provided by the Java platform principally for convenience when developing small or temporary applications or when just\n beginning development.

\n
\n

To enforce this best practice, classes located in default package can no longer be accessed from named ones since Java 1.4.

\n

Noncompliant Code Example

\n
\npublic class MyClass { /* ... */ }\n
\n

Compliant Solution

\n
\npackage org.example;\n\npublic class MyClass{ /* ... */ }\n
" + "body": "\u003cp\u003eAccording to the Java Language Specification:\u003c/p\u003e\n\u003cblockquote\u003e\n \u003cp\u003eUnnamed packages are provided by the Java platform principally for convenience when developing small or temporary applications or when just\n beginning development.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eTo enforce this best practice, classes located in default package can no longer be accessed from named ones since Java 1.4.\u003c/p\u003e\n\u003ch2\u003eNoncompliant Code Example\u003c/h2\u003e\n\u003cpre\u003e\npublic class MyClass { /* ... */ }\n\u003c/pre\u003e\n\u003ch2\u003eCompliant Solution\u003c/h2\u003e\n\u003cpre\u003e\npackage org.example;\n\npublic class MyClass{ /* ... */ }\n\u003c/pre\u003e" }, "location": { "path": "main/java/Library.java", @@ -62,7 +62,7 @@ "severity": "major", "description": "Take the required action to fix the issue indicated by this comment.", "content": { - "body": "

FIXME tags are commonly used to mark places where a bug is suspected, but which the developer wants to deal with later.

\n

Sometimes the developer will not have the time or will simply forget to get back to that tag.

\n

This rule is meant to track those tags and to ensure that they do not go unnoticed.

\n

Noncompliant Code Example

\n
\nint divide(int numerator, int denominator) {\n  return numerator / denominator;              // FIXME denominator value might be  0\n}\n
\n

See

\n" + "body": "\u003cp\u003e\u003ccode\u003eFIXME\u003c/code\u003e tags are commonly used to mark places where a bug is suspected, but which the developer wants to deal with later.\u003c/p\u003e\n\u003cp\u003eSometimes the developer will not have the time or will simply forget to get back to that tag.\u003c/p\u003e\n\u003cp\u003eThis rule is meant to track those tags and to ensure that they do not go unnoticed.\u003c/p\u003e\n\u003ch2\u003eNoncompliant Code Example\u003c/h2\u003e\n\u003cpre\u003e\nint divide(int numerator, int denominator) {\n return numerator / denominator; // FIXME denominator value might be 0\n}\n\u003c/pre\u003e\n\u003ch2\u003eSee\u003c/h2\u003e\n\u003cul\u003e\n \u003cli\u003e \u003ca href\u003d\"http://cwe.mitre.org/data/definitions/546.html\"\u003eMITRE, CWE-546\u003c/a\u003e - Suspicious Comment \u003c/li\u003e\n\u003c/ul\u003e" }, "location": { "path": "main/java/Library.java", @@ -81,7 +81,7 @@ "severity": "critical", "description": "Add a nested comment explaining why this method is empty, throw an UnsupportedOperationException or complete the implementation.", "content": { - "body": "

There are several reasons for a method not to have a method body:

\n\n

Noncompliant Code Example

\n
\npublic void doSomething() {\n}\n\npublic void doSomethingElse() {\n}\n
\n

Compliant Solution

\n
\n@Override\npublic void doSomething() {\n  // Do nothing because of X and Y.\n}\n\n@Override\npublic void doSomethingElse() {\n  throw new UnsupportedOperationException();\n}\n
\n

Exceptions

\n

Default (no-argument) constructors are ignored when there are other constructors in the class, as are empty methods in abstract classes.

\n
\npublic abstract class Animal {\n  void speak() {  // default implementation ignored\n  }\n}\n
" + "body": "\u003cp\u003eThere are several reasons for a method not to have a method body:\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003e It is an unintentional omission, and should be fixed to prevent an unexpected behavior in production. \u003c/li\u003e\n \u003cli\u003e It is not yet, or never will be, supported. In this case an \u003ccode\u003eUnsupportedOperationException\u003c/code\u003e should be thrown. \u003c/li\u003e\n \u003cli\u003e The method is an intentionally-blank override. In this case a nested comment should explain the reason for the blank override. \u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNoncompliant Code Example\u003c/h2\u003e\n\u003cpre\u003e\npublic void doSomething() {\n}\n\npublic void doSomethingElse() {\n}\n\u003c/pre\u003e\n\u003ch2\u003eCompliant Solution\u003c/h2\u003e\n\u003cpre\u003e\n@Override\npublic void doSomething() {\n // Do nothing because of X and Y.\n}\n\n@Override\npublic void doSomethingElse() {\n throw new UnsupportedOperationException();\n}\n\u003c/pre\u003e\n\u003ch2\u003eExceptions\u003c/h2\u003e\n\u003cp\u003eDefault (no-argument) constructors are ignored when there are other constructors in the class, as are empty methods in abstract classes.\u003c/p\u003e\n\u003cpre\u003e\npublic abstract class Animal {\n void speak() { // default implementation ignored\n }\n}\n\u003c/pre\u003e" }, "location": { "path": "main/java/Library.java", @@ -100,7 +100,7 @@ "severity": "major", "description": "Replace this use of System.out or System.err by a logger.", "content": { - "body": "

When logging a message there are several important requirements which must be fulfilled:

\n\n

If a program directly writes to the standard outputs, there is absolutely no way to comply with those requirements. That's why defining and using a\ndedicated logger is highly recommended.

\n

Noncompliant Code Example

\n
\nSystem.out.println(\"My Message\");  // Noncompliant\n
\n

Compliant Solution

\n
\nlogger.log(\"My Message\");\n
\n

See

\n" + "body": "\u003cp\u003eWhen logging a message there are several important requirements which must be fulfilled:\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003e The user must be able to easily retrieve the logs \u003c/li\u003e\n \u003cli\u003e The format of all logged message must be uniform to allow the user to easily read the log \u003c/li\u003e\n \u003cli\u003e Logged data must actually be recorded \u003c/li\u003e\n \u003cli\u003e Sensitive data must only be logged securely \u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eIf a program directly writes to the standard outputs, there is absolutely no way to comply with those requirements. That\u0027s why defining and using a\ndedicated logger is highly recommended.\u003c/p\u003e\n\u003ch2\u003eNoncompliant Code Example\u003c/h2\u003e\n\u003cpre\u003e\nSystem.out.println(\"My Message\"); // Noncompliant\n\u003c/pre\u003e\n\u003ch2\u003eCompliant Solution\u003c/h2\u003e\n\u003cpre\u003e\nlogger.log(\"My Message\");\n\u003c/pre\u003e\n\u003ch2\u003eSee\u003c/h2\u003e\n\u003cul\u003e\n \u003cli\u003e \u003ca href\u003d\"https://wiki.sei.cmu.edu/confluence/x/nzdGBQ\"\u003eCERT, ERR02-J.\u003c/a\u003e - Prevent exceptions while logging data \u003c/li\u003e\n\u003c/ul\u003e" }, "location": { "path": "main/java/Library.java", @@ -138,7 +138,7 @@ "severity": "major", "description": "Replace this usage of \"String.class.isInstance()\" with \"instanceof String\".", "content": { - "body": "

The instanceof construction is a preferred way to check whether a variable can be cast to some type statically because a compile-time\nerror will occur in case of incompatible types. The method isInstance() from java.lang.Class\nworks differently and does type check at runtime only, incompatible types will therefore not be detected early in the developement, potentially\nresulting in dead code. The isInstance() method should only be used in dynamic cases when the instanceof operator can't be\nused.

\n

This rule raises an issue when isInstance() is used and could be replaced with an instanceof check.

\n

Noncompliant Code Example

\n
\nint f(Object o) {\n  if (String.class.isInstance(o)) {  // Noncompliant\n    return 42;\n  }\n  return 0;\n}\n\nint f(Number n) {\n  if (String.class.isInstance(n)) {  // Noncompliant\n    return 42;\n  }\n  return 0;\n}\n\n
\n

Compliant Solution

\n
\nint f(Object o) {\n  if (o instanceof String) {  // Compliant\n    return 42;\n  }\n  return 0;\n}\n\nint f(Number n) {\n  if (n instanceof String) {  // Compile-time error\n    return 42;\n  }\n  return 0;\n}\n\nboolean fun(Object o, String c) throws ClassNotFoundException\n{\n  return Class.forName(c).isInstance(o); // Compliant, can't use instanceof operator here\n}\n
" + "body": "\u003cp\u003eThe \u003ccode\u003einstanceof\u003c/code\u003e construction is a preferred way to check whether a variable can be cast to some type statically because a compile-time\nerror will occur in case of incompatible types. The method \u003ca\nhref\u003d\"https://docs.oracle.com/javase/8/docs/api/java/lang/Class.html#isInstance-java.lang.Object-\"\u003eisInstance()\u003c/a\u003e from \u003ccode\u003ejava.lang.Class\u003c/code\u003e\nworks differently and does type check at runtime only, incompatible types will therefore not be detected early in the developement, potentially\nresulting in dead code. The \u003ccode\u003eisInstance()\u003c/code\u003e method should only be used in dynamic cases when the \u003ccode\u003einstanceof\u003c/code\u003e operator can\u0027t be\nused.\u003c/p\u003e\n\u003cp\u003eThis rule raises an issue when \u003ccode\u003eisInstance()\u003c/code\u003e is used and could be replaced with an \u003ccode\u003einstanceof\u003c/code\u003e check.\u003c/p\u003e\n\u003ch2\u003eNoncompliant Code Example\u003c/h2\u003e\n\u003cpre\u003e\nint f(Object o) {\n\u0026nbsp; if (String.class.isInstance(o)) {\u0026nbsp; // Noncompliant\n\u0026nbsp; \u0026nbsp; return 42;\n\u0026nbsp; }\n\u0026nbsp; return 0;\n}\n\nint f(Number n) {\n\u0026nbsp; if (String.class.isInstance(n)) {\u0026nbsp; // Noncompliant\n\u0026nbsp; \u0026nbsp; return 42;\n\u0026nbsp; }\n\u0026nbsp; return 0;\n}\n\n\u003c/pre\u003e\n\u003ch2\u003eCompliant Solution\u003c/h2\u003e\n\u003cpre\u003e\nint f(Object o) {\n\u0026nbsp; if (o instanceof String) {\u0026nbsp; // Compliant\n\u0026nbsp; \u0026nbsp; return 42;\n\u0026nbsp; }\n\u0026nbsp; return 0;\n}\n\nint f(Number n) {\n\u0026nbsp; if (n instanceof String) {\u0026nbsp; // Compile-time error\n\u0026nbsp; \u0026nbsp; return 42;\n\u0026nbsp; }\n\u0026nbsp; return 0;\n}\n\nboolean fun(Object o, String c) throws ClassNotFoundException\n{\n return Class.forName(c).isInstance(o); // Compliant, can\u0027t use instanceof operator here\n}\n\u003c/pre\u003e" }, "location": { "path": "main/java/Library.java", @@ -157,7 +157,7 @@ "severity": "minor", "description": "Use simple literal for a single-line string.", "content": { - "body": "

If a string fits on a single line, without concatenation and escaped newlines, you should probably continue to use a string literal.

\n

Noncompliant Code Example

\n
\nString question = \"\"\"\n              What's the point, really?\"\"\";\n
\n

Compliant Solution

\n
\nString question = \"What's the point, really?\";\n
\n

See

\n" + "body": "\u003cp\u003eIf a string fits on a single line, without concatenation and escaped newlines, you should probably continue to use a string literal.\u003c/p\u003e\n\u003ch2\u003eNoncompliant Code Example\u003c/h2\u003e\n\u003cpre\u003e\nString question \u003d \"\"\"\n What\u0027s the point, really?\"\"\";\n\u003c/pre\u003e\n\u003ch2\u003eCompliant Solution\u003c/h2\u003e\n\u003cpre\u003e\nString question \u003d \"What\u0027s the point, really?\";\n\u003c/pre\u003e\n\u003ch2\u003eSee\u003c/h2\u003e\n\u003cul\u003e\n \u003cli\u003e \u003ca href\u003d\"https://openjdk.java.net/jeps/378\"\u003eJEP 378: Text Blocks\u003c/a\u003e \u003c/li\u003e\n \u003cli\u003e \u003ca href\u003d\"https://cr.openjdk.java.net/~jlaskey/Strings/TextBlocksGuide_v9.html\"\u003eProgrammer\u0027s Guide To Text Blocks\u003c/a\u003e, by Jim Laskey and Stuart\n Marks \u003c/li\u003e\n\u003c/ul\u003e" }, "location": { "path": "main/java/Library.java", @@ -174,9 +174,9 @@ "type": "issue", "check_name": "java:S5665", "severity": "minor", - "description": "Use '\\\"\"\"' to escape \"\"\".", + "description": "Use \u0027\\\"\"\"\u0027 to escape \"\"\".", "content": { - "body": "

The use of escape sequences is mostly unnecessary in text blocks.

\n

Noncompliant Code Example

\n

\\n can be replaced by simply introducing the newline, \\\"\\\"\\\" it is sufficient to escape only the first qoute.

\n
\nString textBlock = \"\"\"\n        \\\"\\\"\\\" this \\nis\n        text  block!\n        !!!!\n      \"\"\";\n
\n

Compliant Solution

\n
\nString textBlock = \"\"\"\n        \\\"\"\" this\n        is\n        text  block!\n        !!!!\n      \"\"\";\n
\n

See

\n" + "body": "\u003cp\u003eThe use of escape sequences is mostly unnecessary in text blocks.\u003c/p\u003e\n\u003ch2\u003eNoncompliant Code Example\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003e\\n\u003c/code\u003e can be replaced by simply introducing the newline, \u003ccode\u003e\\\"\\\"\\\"\u003c/code\u003e it is sufficient to escape only the first qoute.\u003c/p\u003e\n\u003cpre\u003e\nString textBlock \u003d \"\"\"\n \\\"\\\"\\\" this \\nis\n text block!\n !!!!\n \"\"\";\n\u003c/pre\u003e\n\u003ch2\u003eCompliant Solution\u003c/h2\u003e\n\u003cpre\u003e\nString textBlock \u003d \"\"\"\n \\\"\"\" this\n is\n text block!\n !!!!\n \"\"\";\n\u003c/pre\u003e\n\u003ch2\u003eSee\u003c/h2\u003e\n\u003cul\u003e\n \u003cli\u003e \u003ca href\u003d\"https://openjdk.java.net/jeps/378\"\u003eJEP 378: Text Blocks\u003c/a\u003e \u003c/li\u003e\n \u003cli\u003e \u003ca href\u003d\"https://cr.openjdk.java.net/~jlaskey/Strings/TextBlocksGuide_v9.html\"\u003eProgrammer\u0027s Guide To Text Blocks\u003c/a\u003e, by Jim Laskey and Stuart\n Marks \u003c/li\u003e\n\u003c/ul\u003e" }, "location": { "path": "main/java/Library.java", pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy