Page History

According to the The Java Language Specification, §12.5, "Creation of New Class Instances" [JLS 2005]:

...

Invocation of an overridable method during object construction may result in the use of uninitialized data, leading to runtime exceptions or to unanticipated outcomes. Calling overridable methods from constructors can also leak the this reference before object construction is complete, potentially exposing uninitialized or inconsistent data to other threads . See rule (see TSM01-J. Do not let the this reference escape during object construction for additional information). As a result, constructors must invoke only methods that are final or private.

...

This noncompliant code example results in the use of uninitialized data by the doLogic() method.:

class SuperClass {
  public SuperClass () {
    doLogic();
  }

  public void doLogic() {
    System.out.println("This is superclass!");
  }
}

class SubClass extends SuperClass {
  private String color = null;
  public SubClass() {
    super();
    color = "Red";
  }

  public void doLogic() {
    System.out.println("This is subclass! The color is :" + color);
    // ...
  }
}

public class Overridable {
  public static void main(String[] args) {
    SuperClass bc = new SuperClass();
    // Prints "This is superclass!"
    SuperClass sc = new SubClass();
    // Prints "This is subclass! The color is :null"
  }
}

...

This compliant solution declares the doLogic() method as final so that it cannot be overridden.:

class SuperClass {
  public SuperClass() {
    doLogic();
  }

  public final void doLogic() {
    System.out.println("This is superclass!");
  }
}

...

Allowing a constructor to call overridable methods can provide an attacker with access to the this reference before an object is fully initialized, which could lead to a vulnerability.

Automated Detection

Automated detection of constructors that contain invocations of overridable methods is straightforward.

...

Bibliography

...

      Rule 06: Methods (MET)       Image Added