Sonar Violation: Security - Array is stored directly

java sonarqube
Junchen Liu picture Junchen Liu · Jul 20, 2012 · Viewed 52.7k times · Source

There is a Sonar Violation:

Sonar Violation: Security - Array is stored directly

public void setMyArray(String[] myArray) { 
  this.myArray = myArray; 
}

Solution:

public void setMyArray(String[] newMyArray) { 
  if(newMyArray == null) { 
    this.myArray = new String[0]; 
  } else { 
   this.myArray = Arrays.copyOf(newMyArray, newMyArray.length); 
  } 
}

But I wonder why ?

Answer

Brian Agnew picture Brian Agnew · Jul 20, 2012

It's complaining that the array you're storing is the same array that is held by the caller. That is, if the caller subsequently modifies this array, the array stored in the object (and hence the object itself) will change.

The solution is to make a copy within the object when it gets passed. This is called defensive copying. A subsequent modification of the collection won't affect the array stored within the object.

It's also good practice to normally do this when returning a collection (e.g. in a corresponding getMyArray() call). Otherwise the receiver could perform a modification and affect the stored instance.

Note that this obviously applies to all mutable collections (and in fact all mutable objects) - not just arrays. Note also that this has a performance impact which needs to be assessed alongside other concerns.

Related questions

Turning Sonar off for certain code

Is it possible to turn off sonar (www.sonarsource.org) measurements for specific blocks of code, which one doesn't want to be measured? An example is the "Preserve Stack Trace" warning which Findbugs outputs. When leaving the server, I might …

Read More
How to make Sonar ignore some classes for codeCoverage metric?

I have a Sonar profile in Maven. Everything works fine except the code coverage metric. I want to make Sonar ignore some classes only for the code coverage metric. I have the following profile: <profile> <id>…

Read More
Hide Utility Class Constructor : Utility classes should not have a public or default constructor

I am getting this warning on Sonar.I want solution to remove this warning on sonar. My class is like this : public class FilePathHelper { private static String resourcesPath; public static String getFilePath(HttpServletRequest request) { if(resourcesPath == null) { String serverpath=request.…

Read More