posts - 104,  comments - 34,  trackbacks - 0

          1 )原代碼如下:

          protected String[] a = null;

          public void test(String[] str){

              this.a = str;

          }

          findbugs描述為:

          This code stores a reference to an externally mutable object into the internal representation of the object. If instances are accessed by untrusted code, and unchecked changes to the mutable object would compromise security or other important properties, you will need to do something different. Storing a copy of the object is better approach in many situations.

          網(wǎng)上翻譯如下:

          可能因使引用可指向多個(gè)對(duì)象而暴露內(nèi)部存儲(chǔ)結(jié)構(gòu)。
          這代碼使一個(gè)指向外部多個(gè)對(duì)象的引用指向了一個(gè)內(nèi)部對(duì)象存儲(chǔ)地址。
          如果實(shí)例被未被信任代碼訪(fǎng)問(wèn)或多個(gè)對(duì)象發(fā)生了未經(jīng)檢查的改變就會(huì)危及安全性或其它重要屬性,
          你需要去做一些不同的事情。存儲(chǔ)一個(gè)對(duì)象的拷貝在許多情況下會(huì)是一個(gè)更好的方法。

          修改如下:

          public void test(String[] str){

           

              if(str!=null)

              this.a = str.clone();

          }

          --------------------------------------------------------------------------------

          2 )在bean中定義數(shù)組類(lèi)型的bug

          [參考]http://topic.csdn.net/u/20080115/20/c8893ce0-5546-4762-97bb-9b00d10885cc.html

          原代碼:

          private String[] name;

          public String[] getName() {
          return name;
          }

          public void setName(String[] name) {
          this.name = name;
          }

          bug描述:

          [EI] May expose internal representation by returning reference to mutable object [EI_EXPOSE_REP]

          解決:

          private String[] name;

          public String[] getName() {
          String[] temp = name;
          return temp;
          }

          public void setName(String[] name) {
          String[] temp = name;
          this.name = temp;
          }

          說(shuō)明:

              所有容器類(lèi)型如ArrayList和數(shù)組類(lèi)型,如果你都自動(dòng)生成get set,都會(huì)有這個(gè)警告。
              這個(gè)警告的主要目的是:一般的get set直接把此對(duì)象中某一容器的引用放到外部,可以隨便更改,違反了封裝的原則,至于那個(gè)temp的方法,由于不是直接對(duì)內(nèi)部容器進(jìn)行操作,故沒(méi)有警告,但沒(méi)有實(shí)際意義,自己知道即可。

           

          Returning a reference to a mutable object value stored in one of the object's fields exposes the internal representation of the object. If instances are accessed by untrusted code, and unchecked changes to the mutable object would compromise security or other important properties, you will need to do something different. Returning a new copy of the object is better approach in many situations.

          --------------------------------------------------------------------------------

          3) 序列化問(wèn)題

          源碼:

          private Obj[] obj;

          public void getObj(){

          Obj[] tep = obj;

          return tep;

          }

          public Obj[] setObj(Obj[] o){

          Obj[] tep = o;

          this.obj = tep;

          }

          bug描述:

          This Serializable class defines a non-primitive instance field which is neither transient, Serializable, or java.lang.Object, and does not appear to implement the Externalizable interface or the readObject() and writeObject() methods. Objects of this class will not be deserialized correctly if a non-Serializable object is stored in this field.

          修改:

          public class Obj implements Serializable {

          ...

          }

           

          4 ) new Integer(int) 和 Integer.valueOf(int)  

          bug描述:

          [Bx] Method invokes inefficient Number constructor; use static valueOf instead [DM_NUMBER_CTOR]

          Using new Integer(int) is guaranteed to always result in a new object whereas Integer.valueOf(int) allows caching of values to be done by the compiler, class library, or JVM. Using of cached values avoids object allocation and the code will be faster.

          說(shuō)明:

          [參考]http://www.cnblogs.com/hyddd/articles/1391318.html

          FindBugs推薦使用Integer.ValueOf(int)代替new Integer(int),因?yàn)檫@樣可以提高性能。如果當(dāng)你的int值介于-128~127時(shí),Integer.ValueOf(int)的效率比Integer(int)快大約3.5倍。

          下面看看JDK的源碼,看看到Integer.ValueOf(int)里面做了什么優(yōu)化:

          public static Integer valueOf(int i) {
            
          final int offset = 128;
            
          if (i >= -128 && i <= 127) { // must cache
              return IntegerCache.cache[i + offset];
             }
            
          return new Integer(i);
          }



          private static class IntegerCache {
            
          private IntegerCache(){}
              
            
          static final Integer cache[] = new Integer[-(-128) + 127 + 1];
            
          static {
            
          for(int i = 0; i < cache.length; i++)
                cache
          = new Integer(i - 128);
             }
          }

          從源代碼可以知道,ValueOf對(duì)-128~127這256個(gè)值做了緩存(IntegerCache),如果int值的范圍是:-128~127,在ValueOf(int)時(shí),他會(huì)直接返回IntegerCache的緩存給你。

           

          所以你會(huì)看到這樣的一個(gè)現(xiàn)象:

          public static void main(String []args) {
                Integer a
          = 100;
                Integer b
          = 100;
                System.out.println(a
          ==b);

                Integer c
          = new Integer(100);
                Integer d
          = new Integer(100);
                System.out.println(c
          ==d);
          }

          結(jié)果是:

          true
          false

          因?yàn)椋簀ava在編譯的時(shí)候 Integer a = 100; 被翻譯成-> Integer a = Integer.valueOf(100);,所以a和b得到都是一個(gè)Cache對(duì)象,并且是同一個(gè)!而c和d是新創(chuàng)建的兩個(gè)不同的對(duì)象,所以c自然不等于d。

           

          再看看這段代碼:

           

          public static void main(String args[]) throws Exception{
                   Integer a
          = 100;
                   Integer b
          = a;
                   a
          = a + 1;  //或者a++;
                   System.out.println(a
          ==b);
          }

          結(jié)果是:false

           

          因?yàn)樵趯?duì)a操作時(shí)(a=a+1或者a++),a重新創(chuàng)建了一個(gè)對(duì)象,而b對(duì)應(yīng)的還是緩存里的100,所以輸出的結(jié)果為false。

          --------------------------------------------------------------------------------

          5) toString() 和 String

          源碼:

          return a.toString();

          bug描述

          [Dm] Method invokes toString() method on a String [DM_STRING_TOSTRING]
          Calling String.toString() is just a redundant operation. Just use the String.

          修改為:

          return (String) a;

          ***************************************************************************

          未解決bug

          1、

          [DMI] Code contains a hard coded reference to an absolute pathname [DMI_HARDCODED_ABSOLUTE_FILENAME]

          This code constructs a File object using a hard coded to an absolute pathname (e.g., new File("/home/dannyc/workspace/j2ee/src/share/com/sun/enterprise/deployment");

          posted on 2009-09-30 11:22 末日風(fēng)情 閱讀(5549) 評(píng)論(0)  編輯  收藏 所屬分類(lèi): java編程
          <2009年9月>
          303112345
          6789101112
          13141516171819
          20212223242526
          27282930123
          45678910

          常用鏈接

          留言簿(4)

          隨筆分類(lèi)

          隨筆檔案

          搜索

          •  

          最新評(píng)論

          閱讀排行榜

          評(píng)論排行榜

          主站蜘蛛池模板: 巢湖市| 同江市| 紫阳县| 轮台县| 儋州市| 桦川县| 长汀县| 瑞金市| 芜湖市| 湘潭市| 大冶市| 蕲春县| 鄢陵县| 潞城市| 哈尔滨市| 河津市| 嘉义县| 隆安县| 安福县| 天津市| 天峻县| 林州市| 灵璧县| 汉源县| 苏尼特右旗| 富宁县| 浦东新区| 故城县| 上杭县| 会宁县| 林甸县| 洪江市| 海晏县| 呼图壁县| 磐安县| 松阳县| 东台市| 鹤壁市| 广宁县| 兴国县| 保亭|