Page History

According to The Java Language Specification, §12.5, "Creation of New Class Instances" [JLS 2015]:

Unlike C++, the Java programming language does not specify altered rules for method dispatch during the creation of a new class instance. If methods are invoked that are overridden in subclasses in the object being initialized, then these overriding methods are used, even before the new object is completely initialized.

Invocation of an overridable method during object construction may result in the use of uninitialized data, leading to runtime exceptions or to unanticipated outcomes. Calling overridable methods from constructors can also leak the this reference before object construction is complete, potentially exposing uninitialized or inconsistent data to other threads (see TSM01-J. Do not let the this reference escape during object construction for additional information). As a result, a class's constructor must invoke (directly or indirectly) only methods in that class that are static, final or privateA constructor in the base class can reference uninitialized fields or potentially cause other damage while calling an overridable method. This is because, it is possible for the wrong version (in a sub class) of the method to get invoked.

Noncompliant Code Example

This noncompliant example invokes code example results in the use of uninitialized data by the doLogic method from the constructor. The super class method is invoked on the first call, however, the overriding method is invoked on the second one. The issue is that the constructor for SubClass is not invoked which leaves the value of color as null. () method:

class BaseClassSuperClass {
  public SuperClass BaseClass() {
    doLogic();
  }
	
  public void doLogic() {
    System.out.println("This is super-classsuperclass!");
  }	
}

class SubClass extends BaseClassSuperClass {
  private String color = null;
  public SubClass() {
    super();	
    color = "Redred";
  }
	
  public void doLogic() {
    System.out.println("This is sub-classsubclass! The color is :" + color); //color becomes null
    //other operations...
  }
}

public class Overridable {
  public static void main(String[] args) {
    BaseClassSuperClass bc = new BaseClassSuperClass();
    //prints Prints "This is super-classsuperclass!"
    BaseClassSuperClass sc = new SubClass();
    //prints Prints "This is sub-classsubclass! The color is :null"		
  }
}

The doLogic() method is invoked from the superclass's constructor. When the superclass is constructed directly, the doLogic() method in the superclass is invoked and executes successfully. However, when the subclass initiates the superclass's construction, the subclass's doLogic() method is invoked instead. In this case, the value of color is still null because the subclass's constructor has not yet concluded.

Compliant Solution

This compliant solution declares the doLogic() method as final so that it is no longer overridable.cannot be overridden:

class BaseClassSuperClass {
  public BaseClassSuperClass() {
    doLogic();
  }
	
  public final void doLogic() {
    System.out.println("This is super-classsuperclass!");
  }	
}

Risk Assessment

TODOAllowing a constructor to call overridable methods can provide an attacker with access to the this reference before an object is fully initialized, which could lead to a vulnerability.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

Automated Detection

Automated detection of constructors that contain invocations of overridable methods is straightforward.

Related Guidelines

Bibliography

...

Image Added Image Added Image AddedJLS, Chapter 8