Page History

...

Passing arguments to certain Java Collection Framework methods that are of a different type from that of the class instance can cause silent failures, resulting in unintended object retention, memory leaks, or incorrect program operation [Techtalk 2007].

Automated Detection

Detection of invocations of Collection.remove() whose operand fails to match the type of the elements of the underlying collection is straightforward. It is possible, although unlikely, that some of these invocations could be intended. The remainder are heuristically likely to be in error. Automated detection for other APIs could be possible.

Bibliography

[Core Java 2004]	Chapter 5, "Inheritance"
[JCF 2014]	The Java Collections Framework
[JLS 2015]	§5.1.7, "Boxing Conversions"
[Seacord 2015]	Image Modified IDS17-J. Prevent XML External Entity Attacks LiveLesson
[Techtalk 2007]	"The Joy of Sets"

...

...

Image Modified Image Modified Image Modified