SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 45 Next »

Never use deprecated fields, methods, or classes in new code. The Java SE 6 documentation provides a complete list of deprecated APIs [[API 2006]]. Java provides a @deprecated annotation to indicate the deprecation of specific fields, methods, and classes. For instance, many methods of java.util.Date, such as Date.getYear(), have been explicitly deprecated. The guideline THI05-J. Do not use Thread.stop() to terminate threads describes issues that can result from using the deprecated Thread.stop() method.

Obsolete fields, methods, and classes should not be used. Java provides no annotation to indicate obsolescence, but several objects are documented as obsolete. For instance, the java.util.Dictionary class is marked as obsolete, and new code should use java.util.Map<K,V> instead [[API 2006]].

Finally, several classes and methods impose particular limitations on their use. For instance, all of the subclasses of the abstract class java.text.Format are thread-unsafe. These classes must be avoided in multithreaded code. For more information about thread-safety, see guideline TSM04-J. Document thread-safety and use annotations where applicable.

Obsolete Methods and Classes

The following methods and classes must not be used:

Class or Method

Replacement

Guideline

java.lang.Character.isJavaLetter()

java.lang.Character.isJavaIdentifierStart()

java.lang.Character.isJavaLetterOrDigit()

java.lang.Character.isJavaIdentifierPart()

java.lang.Character.isSpace()

java.lang.Character.isWhitespace()

java.lang.reflect.Class.newInstance()

java.lang.reflect.Constructor.newInstance()

ERR10-J. Do not let code throw undeclared checked exceptions

java.util.Date (many methods)

java.util.Calendar

java.util.Dictionary

java.util.Map<K,V>

java.util.Properties.save()

java.util.Properties.store()

Risk Assessment

Using deprecated or obsolete classes or methods in program code can lead to erroneous behavior.

Guideline

Severity

Likelihood

Remediation Cost

Priority

Level

MET15-J

high

likely

medium

P18

L1

Automated Detection

Detecting uses of deprecated methods is straightforward. Obsolete methods and thread-unsafe methods have no automatic means of detection.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

[[API 2006]] Deprecated API, Dictionary
[[SDN 2008]] Bug database, Bug ID 4264153
[[MITRE 2009]] CWE-589

MET14-J. Follow the general contract when implementing the compareTo() method      05. Methods (MET)      MET17-J. Do not increase the accessibility of overridden or hidden methods

  • No labels