Wiki Markup |
---|
The Java compiler type-checks the arguments to a varargs method to ensure that they are of the same type or object reference. However, the compile-time checking is ineffective when two method signatures are used in particular - {{Object}} and the generic type {{T}} \[[Bloch 08|AA. Java References#Bloch 08]\]. Another requirement for providing strong compile-time type checking of variable argument methods is to be as specific as possible when declaring the type of the method parameter. |
Noncompliant Code Example
This noncompliant code example declares two methods, one with an Object
parameter and another with a generic type T
. Both these approaches are flawed as they break strong compile-time type checking.
Code Block | ||
---|---|---|
| ||
ReturnType1 suspect1(Object... args) { } <T> ReturnType2 suspect2(T... args) { } |
Compliant Solution
Do not use generic types like Object
in varargs and be as specific as possible when declaring parameter types.
...
Also, note that autoboxing does not allow strong compile time type checking of primitive types and their corresponding wrapper classes.
Risk Assessment
Unmindful use of the varargs feature breaks strong compile-time type checking, creates ambiguity and diminishes code readability.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
DCL08- J | low | unlikely | medium | P2 | L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
Wiki Markup |
---|
\[[Sun 06|AA. Java References#Sun 06]\] [varargs|http://java.sun.com/j2se/1.5.0/docs/guide/language/varargs.html] \[[Bloch 08|AA. Java References#Bloch 08]\] Item 42: "Use varargs judiciously" \[[Steinberg 05|AA. Java References#Steinberg 05]\] "Using the Varargs Language Feature" |
...