Page History

...

Noncompliant Code Example

This noncompliant examples is designed to rename a given file if it is present, perform operations on it and then delete it. It can be deceptive that the renameTo() method will execute when the exists() method returns true, and an unsuspecting developer would incorrectly delete the new non-existent file instead of the original one. This problem is exacerbated by the fact that File.delete() does not throw an exception but returns an error code on failure, which is often silently ignored or perceived as unnecessary. (See EXP02-J. Do not ignore values returned by methods)

class BadRenameFile {
  public static void main(String[] args) {
    File fOriginal = new File("original.txt");
    File fNew = new File("new.txt");

    if(fOriginal.exists() || fOriginal.renameTo(fNew)) {
      // do something with fNew
      fNew.delete(); // fNew does not exist as renameTo() was not executed
    }
  }
} 

Compliant Solution

Knowledge of the short-circuit behavior can be used to enforce the desired specification. This program traps an error if the file does not exist or when it cannot be renamed to the new file name. Operations on the new file follow.

class RenameFile {
  public static void main(String[] args) {
    File fOriginal = new File("original.txt");
    File fNew = new File("new.txt");

    if(!fOriginal.exists() || !fOriginal.renameTo(fNew)) {
      // handle error
    }
    // do something with fNew
    if(!fNew.delete()) {
      // handle error  
    }
  }
} 

Noncompliant Code Example

In this noncompliant example, the programmer has combined two expressions in the if statement. The first checks whether the 'd' object is null and the second checks if the default security manager exists depending on which the security check will be performed. This is a classic case of trying to club together two null} checks into one statement. A conditional '&&' is used as using a conditional '||' would mean that whenever 'd' is null, the complete expression can still succeed depending on the value of {{sm (see the next noncompliant example). This would violate the invariants of d since it is desired that operations on it be prohibited if it is null.

...

// d = null
SecurityManager sm = System.getSecurityManager();	  
if(d != null && sm != null) {
  FilePermission perm = new FilePermission("file.dat", "read");
  sm.checkPermission(perm);
  /* do something with d */
}
/* read the file (skips security check) */

Noncompliant Code Example

In this example, the programmer switches the ordering of the two subexpressions and uses a '||' operator to ensure the security check is carried out but does not realize that the second check would not be carried out if the first one succeeds. The result is the inadvertent modification of 'd'.

SecurityManager sm = System.getSecurityManager();	  
if(sm != null || d != null) {
  FilePermission perm = new FilePermission("file.dat", "read");
  sm.checkPermission(perm);
  // do something with d
}
// read the file

Compliant Solution

Decouple distinct operations that use the conditional AND and OR operators from expressions constituting decision statements. When inevitable, be aware of the short-circuit behavior and code accordingly.

...