Page History

The compiler issues unchecked warnings when it When the compiler detects potential type-safety issues arising from mixing raw types with generic code. This includes , it issues unchecked warnings, including unchecked cast warnings, unchecked method invocation warnings, unchecked generic array creation warnings, and unchecked conversion warnings [Bloch 2008]. It is permissible to use the @SuppressWarnings("unchecked") annotation to suppress unchecked warnings when, and only when, the warning-emitting code is guaranteed to be type safe. A common use case is mixing legacy code with new client code. The perils of ignoring unchecked warnings are discussed extensively in OBJ03-J. Do not mix generic with nongeneric raw types in new code.

According to the Java API [API 2006], Annotation Type SuppressWarnings documentation [API 2014],

As a matter of style, programmers should always use this annotation on the most deeply nested element where it is effective. If you want to suppress a warning in a particular method, you should annotate that method rather than its class.

The @SuppressWarnings annotation can be used in the declaration of variables and methods as well as an entire class. It is, however, very important to narrow down its scope so that other noteworthy warnings within the same scope are not silently ignoredonly those warnings that occur in the narrower scope are suppressed.

Noncompliant Code Example

In this noncompliant code example, the @SuppressWarnings annotation's scope encompasses the whole class. This is dangerous because all unchecked warnings within the class will be suppressed. Oversights of this nature can lead to a ClassCastException at runtime.:

@SuppressWarnings("unchecked") 
class Legacy {
  Set s = new HashSet();
  public final void doLogic(int a, char c) {
    s.add(a);
    s.add(c); // Type -unsafe operation, ignored
  }
}

This code is dangerous because all unchecked warnings within the class are suppressed. Oversights of this nature can lead to a ClassCastException at runtime.

Compliant Solution

Limit the scope of the @SuppressWarnings annotation to the nearest unchecked warning-generating codecode that generates a warning. In this case, it may be used in the declaration for the Set.:

class Legacy {
  @SuppressWarnings("unchecked")
  Set s = new HashSet();
  public final void doLogic(int a,char c) {
    s.add(a); // Produces unchecked warning
    s.add(c); // Produces unchecked warning
  }
}

Noncompliant Code Example (ArrayList)

This noncompliant code example is from the an old implementation of java.util.ArrayList. When the class is compiled, it emits an unchecked cast warning, as shown. Because the return statement is not a declaration, the Java Language Specification [JLS 2005] makes it impossible to suppress the warning trivially. Consequently, the @SuppressWarnings is used over method scope. This can cause issues when some functionality that performs type-unsafe operations is added to the method at a later date [Bloch 2008].:

@SuppressWarnings("unchecked")
public <T> T[] toArray(T[] a) {
  if (a.length < size) {
    // Produces unchecked warning
    return (T[]) Arrays.copyOf(elements, size, a.getClass()); //
 Produces unchecked warning}
  // ...
}

When the class is compiled, it emits an unchecked cast warning:

// Unchecked cast warning
ArrayList.java:305: warning: [unchecked] unchecked cast found : 
  Object[], required: T[]
return (T[]) Arrays.copyOf(elements, size, a.getClass());

...

This warning cannot be suppressed for just the return statement because it is not a declaration [JLS 2011]. As a result, the programmer suppresses warnings for the entire method. This can cause issues when functionality that performs type-unsafe operations is added to the method at a later date [Bloch 2008].

Compliant Solution (ArrayList)

When it is impossible to use the @SuppressWarnings annotation in an appropriate scope, as in the preceding noncompliant code example, declare a new variable to hold the return value and adorn it with the @SuppressWarnings annotation.

// ...
@SuppressWarnings("unchecked") 
T[] result =
 (T[]) Arrays.copyOf(elements, size, a.getClass());
return result;
// ...

...

Applicability

Failure to reduce the scope of the @SuppressWarnings annotation can lead to runtime exceptions and break type-safety guarantees.

...

Recommendation

...

...

Likelihood

...

Remediation Cost

...

Priority

...

Level

...

MSC07-J

...

medium

...

probable

...

high

...

P4

...

L3

Automated Detection

This rule cannot be statically enforced in full generality; however, static analysis could be possible for some interesting special cases.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

Bibliography

...

...

...

Image Added Image Added Image AddedImage Removed      49. Miscellaneous (MSC)      MSC52-J. Do not place a semicolon on the same line as an if, for, or while statement