CODEWITHSUNDEEP
javasonarqubethisimmutability
Vamsidhar
Vamsidhar

Reputation: 832

Why is returning this.variable not a vulnerability?

Sonar rule squid:S2384 raises an issue on this code:

public Date getCreatedOn() {
    return createdOn;
}

following the rule Mutable members should not be stored or returned directly

I understand that we should not return the original, instead we should return a copy of the object.

On the other hand, Sonar does not raise an issue on this code:

public Date getCreatedOn() {
    return this.createdOn;
}

What makes this code different?

Are we not returning the original copy in the 2nd case?

Upvotes: 8

Views: 1969

Answers (2)

Tibor Blenessy
Tibor Blenessy

Reputation: 4420

This is a deficiency in a way how SonarJava (Java static code analyzer used in SonarQube platform) detects this issue. I created following ticket to improve the implementation to cover cases when field is returned using this .

https://jira.sonarsource.com/browse/SONARJAVA-2424

Upvotes: 10

Rakesh Ray
Rakesh Ray

Reputation: 72

the code you have shared is same. but the link you have shared is different.

if a class have data-member of reference type and it is mutable and when we are returning directly we are referring the same object, so it can be modified. It is better to return value of an object by another object.

Upvotes: -3

Related Questions