Sonar Violation: Security – Array is stored directly

by

It’s complaining that the array you’re storing is the same array that is held by the caller. That is, if the caller subsequently modifies this array, the array stored in the object (and hence the object itself) will change.

The solution is to make a copy within the object when it gets passed. This is called defensive copying. A subsequent modification of the collection won’t affect the array stored within the object.

It’s also good practice to normally do this when returning a collection (e.g. in a corresponding getMyArray() call). Otherwise the receiver could perform a modification and affect the stored instance.

Note that this obviously applies to all mutable collections (and in fact all mutable objects) – not just arrays. Note also that this has a performance impact which needs to be assessed alongside other concerns.

More Related Contents:

  1. Turning Sonar off for certain code
  2. New Integer vs valueOf
  3. Configure Sonar to exclude files from Maven pom.xml
  4. Restricting JTextField input to Integers [duplicate]
  5. After Google Play Service update to version 13 I got an error
  6. Abstract class vs Interface in Java
  7. Connection to Db dies after >4
  8. byte[] to file in Java
  9. POST request via RestTemplate in JSON
  10. What is more efficient: System.arraycopy or Arrays.copyOf?
  11. Why does String.valueOf(null) throw a NullPointerException?
  12. How to insert a character in a string at a certain position?
  13. How to find and kill running Win-Processes from within Java?
  14. How to get subnet mask of local system using java?
  15. Java method dispatch with null argument
  16. Why are class static methods inherited but not interface static methods?
  17. Integer vs int: with regard to memory
  18. simple java regex throwing illegalstateexception [duplicate]
  19. How to persist permission in android API 19 (KitKat)?
  20. Caused by: java.lang.ClassNotFoundException: Didn’t find class in Firebase Phone Authentication
  21. Java Reflection: Why is it so slow?
  22. How to read text inside body of mail using javax.mail
  23. Choosing random numbers efficiently
  24. What’s the best way to get a Class object for an array type?
  25. Proper implementation of cubic spline interpolation
  26. Form submit in Spring MVC 3 – explanation
  27. Apparent connection leak detected with Hikari CP
  28. Problems with clear case plugin eclipse
  29. Getting unwanted characters when reading command output from SSH server using JSch
  30. Is there a SaxParser that reads json and fires events so it looks like xml

Leave a Comment