Page History

Wiki Markup
Deprecated methods should not be used in new code. Refer to the complete list of deprecated APIs available in the Java SE 6 documentation. \[[API 06\|AA. Java References#API 06]\].

The guideline CON17-J. Do not invoke ThreadGroup methods Never use deprecated fields, methods, or classes in new code. Java provides an @deprecated annotation to indicate the deprecation of specific fields, methods, and classes. For example, many methods of java.util.Date, such as Date.getYear(), have been explicitly deprecated. THI05-J. Do not use Thread.stop() to terminate threads describes issues that can result from using deprecated and obsolete methods. the deprecated Thread.stop() method.

The Java SE documentation provides a list of deprecated APIs for each version of the language:

Programmers should use the list of deprecated functions specific to the language version they are using, although it may also be possible to avoid the use of APIs that are deprecated in later versions as well if suitable alternatives are available.

Obsolete fields, methods, and classes should not be used. Java lacks any annotation that indicates obsolescence; nevertheless, several classes and methods are documented as obsolete. For instanceA class is obsolete if it is unofficially deprecated. For example, the java.util.Dictionary class provides the same functionality as the Map interface and is generally outmoded. The java.util.Calendar class suffers from multi-threading related issues and so does its subclasses, such as, java.util.GregorianCalendar. Similarly, all the subclasses of the abstract class java.text.Format are thread-unsafe. These classes must be avoided in multi-threaded codeDictionary<K,V> class is marked as obsolete; new code should use java.util.Map<K,V> instead [API 2014].

Obsolete Methods and Classes

The methods and classes listed in the following table must not be used:

Class or Method	Replacement	Rule
`java.lang.Character.isJavaLetter()`	`java.lang.Character.isJavaIdentifierStart()`
`java.lang.Character.isJavaLetterOrDigit()`	`java.lang.Character.isJavaIdentifierPart()`
`java.lang.Character.isSpace()`	`java.lang.Character.isWhitespace()`
`java.lang.Class.newInstance()`	`java.lang.reflect.Constructor.newInstance()`	ERR06-J. Do not throw undeclared checked exceptions
`java.util.Date` (many methods)	`java.util.Calendar`
`java.util.Dictionary<K,V>`	`java.util.Map<K,V>`
`java.util.Properties.save()`	`java.util.Properties.store()`
`java.lang.Thread.run()`	`java.lang.Thread.start()`	THI00-J. Do not invoke Thread.run()
`java.lang.Thread.stop()`	`java.lang.Thread.interrupt()`	THI05-J. Do not use Thread.stop() to terminate threads
`java.lang.ThreadGroup` (many methods)	`java.util.concurrent.Executor`	THI01-J. Do not invoke ThreadGroup methods
java.util.Date	java.time (since Java 8)

The Java Virtual Machine Profiler Interface (JVMPI) and JVM Debug Interface (JVMDI) are also deprecated and have been replaced by the JVM Tool Interface (JVMTI) (see ENV05-J. Do not deploy an application that can be remotely monitored for more information).

Risk Assessment

Using deprecated or obsolete classes or methods in program code can lead to unexpected, ill-defined erroneous behavior.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level

MET15

MET02-J

high

Low

likely

Unlikely

medium

Medium

P18

P2

L1

L3

Automated Detection

...

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

Wiki Markup

\[[API 06|AA. Java References#API 06]\] [Deprecated API|http://java.sun.com/javase/6/docs/api/deprecated-list.html]
\[[SDN 08|AA. Java References#SDN 08]\] Bug database, [Bug ID 4264153|http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4264153]
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 589|http://cwe.mitre.org/data/definitions/589.html]

Detecting uses of deprecated methods is straightforward. Obsolete methods have no automatic means of detection.
Tool Version Checker Description
Parasoft Jtest
Include Page
Parasoft_V
Parasoft_V
CERT.MET02.DPRAPI
CERT.MET02.THRD Do not use deprecated APIs
Avoid calling unsafe deprecated methods of 'Thread' and 'Runtime'
SonarQube
Include Page
SonarQube_V
SonarQube_V
S1874 "@Deprecated" code should not be used

Related Guidelines

ISO/IEC TR 24772:2010	Deprecated Language Features [MEM]
MITRE CWE	CWE-589, Call to Non-ubiquitous API

Android Implementation Details

The Android SDK has deprecated and obsolete APIs. Also, there may exist incompatible APIs depending on the SDK version. Consequently, it is recommended that developers refer to the "Android API Differences Report" and consider replacing deprecated APIs.

Bibliography

[API 2014]	Deprecated API Interface `Map<K,V>`
[SDN 2008]	Bug database, Bug ID 4264153

...

Image Added Image Added Image Added MET14-J. Follow the general contract when implementing the compareTo method 12. Methods (MET) MET16-J. Ensure that the clone method calls super.clone

Space shortcuts

Page tree

Versions Compared

Old Version 16

New Version Current

Key