| Wiki Markup |
|---|
A boxing conversion converts the value of a primitive type to the corresponding value of the reference type, for example, from {{int}} to {{Integer}} \[[JLS 2005|AA. Bibliography#JLS 05]\]. This is convenient in cases where an object parameter is required, such as with collection classes like {{Map}} and {{List}}. Another use case is for interoperation with methods that require their parameters to be object references rather than primitive types. Automatic conversion to the resulting wrapper types also reduces clutter in code. |
...
| Wiki Markup |
|---|
This noncompliant code example prints {{100}} as the size of the {{HashSet}} rather than the expected result ({{1}}). The combination of values of types {{short}} and {{int}} in the operation {{i-1}} causes the result to be autoboxed into an object of type {{Integer}}, rather than one of type {{Short}}. See guideline "[NUM18-J. Be aware of numeric promotion behavior]" for additional explanation of the details of the promotion rules. The {{HashSet}} contains only values of type {{Short}}; the code attempts to remove objects of type {{Integer}}. Consequently, the {{remove()}} operation accomplishes nothing. The language's type checking guarantees that only values of type {{Short}} can be inserted into the {{HashSet}}. Nevertheless, programmers are free to attempt to remove an object of _any_ type, because {{Collections<E>.remove()}} accepts an argument of type {{Object}} rather than of type {{E}}. Such behavior can result in unintended object retention or memory leaks \[[Techtalk 2007|AA. Bibliography#Techtalk 07]\]. |
...
Detection of invocations of Collection.remove() whose operand fails to match the type of the elements of the underlying collection is straightforward. It is possible, albeit unlikely, that some of these invocations could be intended. The remainder are heuristically likely to be in error. Automated detection for other APIs may could be possible.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Bibliography
| Wiki Markup |
|---|
\[[Core Java 2004|AA. Bibliography#Core Java 04]\] Chapter 5 \[[JLS 2005|AA. Bibliography#JLS 05]\] [Section 5§5.1.7, "Boxing Conversions" |http://java.sun.com/docs/books/jls/third_edition/html/conversions.html#5.1.7] \[[Techtalk 2007|AA. Bibliography#Techtalk 07]\] "The Joy of Sets" |
...