Page History

...

Consequently, invocation of an overridable method during object construction may result in the use of uninitialized data, leading to runtime exceptions or to unanticipated outcomes. Calling overridable methods from constructors can also leak the this reference before object construction is complete, potentially exposing uninitialized or inconsistent data to other threads. See rule TSM01-J. Do not let the (this) reference escape during object construction for additional information. As a result, constructors may invoke only methods that are final or private; all other method invocations are forbidden.

Noncompliant Code Example

This noncompliant code example results in the use of uninitialized data by the doLogic() method.

...

The doLogic() method is invoked from the superclass's constructor. When the superclass is constructed directly, the doLogic() method in the superclass is invoked and executes successfully. However, when the subclass initiates the superclass's construction, the subclass's doLogic() method is invoked instead. In this case, the value of color is still null because the subclass's constructor has not yet concluded.

Compliant Solution

This compliant solution declares the doLogic() method as final so that it cannot be overridden.

class SuperClass {
  public SuperClass() {
    doLogic();
  }

  public final void doLogic() {
    System.out.println("This is superclass!");
  }
}

Risk Assessment

Allowing a constructor to call overridable methods may give an attacker access to the this reference before an object is fully initialized, which in turn could lead to a vulnerability.

Automated Detection

Automated detection of constructors that contain invocations of overridable methods appears to be straightforward.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Bibliography

...