The compiler issues unchecked warnings when it detects potential type-safety issues arising from mixing raw types with generic code. This includes unchecked cast warnings, unchecked method invocation warnings, unchecked generic array creation warnings, and unchecked conversion warnings [java:Bloch 2008]. It is permissible to use the @SuppressWarnings("unchecked") annotation to suppress unchecked warnings when, and only when, the warning-emitting code is guaranteed to be typesafetype safe. A common usecase use case is mixing legacy code with new client code. The perils of ignoring unchecked warnings are discussed extensively in rule OBJ03-J. Do not mix generic with nongeneric raw types in new code.
According to the Java API [java:API 2006], Annotation Type SuppressWarnings documentation,
As a matter of style, programmers should always use this annotation on the most deeply nested element where it is effective. If you want to suppress a warning in a particular method, you should annotate that method rather than its class.
The @SuppressWarnings annotation can be used in the declaration of variables and methods , as well as an entire class. It is, however, very important to narrow down its scope so that other noteworthy warnings within the same scope are not silently ignored.
...
Limit the scope of the @SuppressWarnings annotation to the nearest unchecked warning-generating code. In this case, it may be used in the declaration for the Set.
...
This noncompliant code example is from the implementation of java.util.ArrayList. When the class is compiled, it emits an unchecked cast warning, as shown. Because the return statement is not a declaration, the Java Language Specification [java:JLS 2005] makes it impossible to suppress the warning trivially. Consequently, the @SuppressWarnings is used over method scope. This can cause issues when some functionality that performs type-unsafe operations is added to the method at a later date [java:Bloch 2008].
| Code Block | ||
|---|---|---|
| ||
@SuppressWarnings("unchecked")
public <T> T[] toArray(T[] a) {
if (a.length < size)
return (T[]) Arrays.copyOf(elements, size, a.getClass()); // Produces unchecked warning
// ...
}
|
...
Failure to reduce the scope of the @SuppressWarnings annotation can lead to runtime exceptions and break type-safety guarantees.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MSC07-J | medium | probable | high | P4 | L3 |
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Bibliography
[java:Bloch 2008] Item 24: "Eliminate unchecked warnings"
...