Page History

...

Overriding legacy classes and generifying the overriding method is not a panacea as this is made illegal by the Java Language Specification [JLS 05]. It is best to avoid mixing generic and non-generic code.

Noncompliant Code Example

This noncompliant code example produces an unchecked warning because the raw type of the List.add() method is used (the list parameter in addToList() method) instead of the parameterized type. To make this code compile cleanly, the @SuppressWarnings annotation is used.

...

Exception in thread "main" java.lang.ClassCastException: java.lang.Integer cannot be cast to java.lang.String
	at Raw.print(Test.java:11)
	at Raw.main(Test.java:14)

Compliant Solution

By gleaning information from the diagnostic exception message, the error can be quickly traced to the line addToList(1) in the noncompliant code example. Changing this to addToList("1") is unfortunately a superficial defense. To resolve the real issue, parameterized types must be used consistently and not just abundantly.

...

class Parameterized {
  private static void addToList(List<String> list, String str) {
    list.add(str);     // Unchecked warning
  }
  private static void print() {
    List<String> list = new ArrayList<String> ();
    addToList(list, "1");
    System.out.println(list.get(0));
  }
  public static void main(String[] args) {
    Parameterized.print();
  }
}

Noncompliant Code Example

This noncompliant code example suffers from related pitfalls. It compiles and runs cleanly. The method printOne() intends to print the value one, either as an int or as a double depending on the type of the variable type. However, despite list being correctly parameterized, this method always print '1' and never '1.0' because the int value '1' is always added to list without being type checked.

...

This code produces the output:

1.0 
1  
1
1

Compliant Solution

If possible, the addToList() method should be generified to eliminate possible type violations.

...

If the method addToList() is externally defined (such as in a library or is an upcall method) and cannot be changed, the same compliant method printOne() can be used, but no warnings result if addToList(1) is used instead of addToList(1.0). Great care must be taken to ensure type safety when generics are mixed with non-generic code.

Exceptions

EX1: Raw types must be used in class literals. For example, as List<Integer>.class is illegal, it is permissible to use the raw type List.class. [Bloch 08]

...

if(o instanceof Set) { // Raw type
Set<?> m = (Set<?>) o; // Wildcard type 
...
}

Risk Assessment

Mixing generic and non-generic code may produce unexpected results and exceptional conditions.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[Langer 08|AA. Java References#Langer 08]\] Topic 3, "[Coping with Legacy|http://www.angelikalanger.com/GenericsFAQ/FAQSections/ProgrammingIdioms.html#Topic3]"
[[Bloch 08|AA. Java References#Bloch 08]\] Item 23: "Don't use raw types in new code"
[[Bloch 07|AA. Java References#Bloch 07]\] Generics, 1. "Avoid Raw Types in New Code"
\[[Naftalin 06b|AA. Java References#Naftalin 06b]\] "Principle of Indecent Exposure"
[[JLS 05|AA. Java References#JLS 05]\] 4.8 "Raw types" and 5.1.9 "Unchecked Conversion"

...