SonarQube扫描常见Bug、漏洞修复整理(持续更新中)
目录
- DMS
- 1、A "NullPointerException" could be thrown; "sra" is nullable here.
- 2、Cast one of the operands of this multiplication operation to a "long"
- 3、Call "remove()" on "requestContainer".
- 4、Use try-with-resources or close this "FileInputStream" in a "finally" clause.
- 5、Change this condition so that it does not always evaluate to "false"
- 6、Use the "equals" method if value comparison was intended.
- 7、Do something with the "boolean" value returned by "delete".
- 8、Either re-interrupt this method or rethrow the "InterruptedException" that can be caught here.
- DQC
DMS
1、A “NullPointerException” could be thrown; “sra” is nullable here.
这种提示是指可能存在空指针异常,需要增加空值检测。
说明:未做非空校验,可能产生空指针
解决方案:加上非空校验
解决方式:先判断或者先实例化,再访问里面的属性或者成员。
2、Cast one of the operands of this multiplication operation to a “long”
说明:int数运算最终再把结果转为long将有可能产生溢出
解决方案:转换为long型预算 举例: long bigNum = Integer.MAX_VALUE + 2; // Noncompliant. Yields -2147483647 换为 long bigNum = Integer.MAX_VALUE + 2L;
3、Call “remove()” on “requestContainer”.
说明:防止内存泄露溢出,ThreadLocal字段【requestContainer】应该至少调用一次remove()方法。
// 解决方案:定义删除方法 public void removeRequest() { requestContainer.remove(); }
4、Use try-with-resources or close this “FileInputStream” in a “finally” clause.
说明:使用try-with-resources或在 “finally” 子句中关闭此 “BufferedOutputStream”。
// 解决方案1:使用try-with-resources BufferedOutputStream out = null; try(BufferedOutputStream out = new BufferedOutputStream(new FileOutputStream(new File("C://test"))) { out.write(file.getBytes()); out.flush(); return Result.success("上传成功!", null); } catch (IOException e) { return Result.error("上传失败!"); }
// 解决方案2:“finally” 子句中关闭流 BufferedOutputStream out = null; try { out = new BufferedOutputStream(new FileOutputStream(new File("C://test")); out.write(file.getBytes()); out.flush(); return Result.success("上传成功!", null); } catch (IOException e) { return Result.error("上传失败!"); } finally { CloseIoUtils.closeAll(out); }
5、Change this condition so that it does not always evaluate to “false”
说明:checkInsertParam方法没有返回false的情况一直是true,所以条件判断后一直返回的结果为false。需要改条件判断或者添加方案中异常false情况返回。
6、Use the “equals” method if value comparison was intended.
说明:使用引用等式==或!=,比较java.lang.String或装箱类型(如java.lang.Integer)的两个实例几乎总是一个错误,因为它不是比较实际值,而是比较内存中的位置
解决:将 “==” 换成 equals 比较
7、Do something with the “boolean” value returned by “delete”.
//解决方案:增加false判断if (!csvFile.delete()) { log.error("文件删除失败");}
8、Either re-interrupt this method or rethrow the “InterruptedException” that can be caught here.
//解决方案 try(){ //业务代码... }catch (InterruptedException e){ //抛出InterruptedException 异常需要重新清除线程的中断状态,添加如下 Thread.currentThread().interrupt(); }
DQC
1、Use “BigDecimal.valueOf” instead.
说明:由于浮点不精确,您不太可能从BigDecimal(double)构造函数中获得预期的值。
//解决方案 BigDecimal.valueOf((double) (Float) r)
2、Remove this “break” statement or make it conditional.
说明:移除break;或者把它放在条件中
3、Remove this conditional structure or edit its code blocks so that they’re not all the same.
说明:写if else的时候,卡条件卡得离散了一点,本身可以合成一个的,结果写成了多级if,增加了程序的复杂度。
解决:去掉if else语句
来源地址:https://blog.csdn.net/baidu_41937166/article/details/128393987
免责声明:
① 本站未注明“稿件来源”的信息均来自网络整理。其文字、图片和音视频稿件的所属权归原作者所有。本站收集整理出于非商业性的教育和科研之目的,并不意味着本站赞同其观点或证实其内容的真实性。仅作为临时的测试数据,供内部测试之用。本站并未授权任何人以任何方式主动获取本站任何信息。
② 本站未注明“稿件来源”的临时测试数据将在测试完成后最终做删除处理。有问题或投稿请发送至: 邮箱/279061341@qq.com QQ/279061341