...
This code uses == to compare two integer objects. From EXP03-J we know that for == to return true for two object references, they must point to the same underlying object. We thus as a result deduce that the results of using the == operator here will be misleading.
...
| Wiki Markup |
|---|
This noncompliant code snippet \[[Techtalk 07|AA. Java References#Techtalk 07]\] prints {{100}} as the size of the {{HashSet}} while it is expected to print {{1}}. The combination of a {{short}} and an {{integer}} value in the operation {{i-1}} leads to autoboxing into an {{Integer}} object. The {{HashSet}} contains only {{short}} values whereas (distinctly typed) {{Integer}} objects are being removed successively. The remove operation is as a thusresult equivalent to a _No Operation_ (NOP). The compiler enforces type checking so that only {{short}} values are inserted, however, a programmer is free to remove an object of any type without triggering any exceptions since {{Collections<E>.remove}} takes an Object parameter and not {{E}}. Such behavior can result in unintended object retention or memory leaks. |
...
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP05- J | low | probable | high | P2 | L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[Core Java 04|AA. Java References#Core Java 04]\] Chapter 5 \[[JLS 05|AA. Java References#JLS 05]\] Section 5.1.7 \[[Techtalk 07|AA. Java References#Techtalk 07]\] "The Joy of Sets" |
...