FindBugs Report

FindBugs Report

Contents

Warnings

Click on a warning row to see full context information.

Correctness Warnings

Code  Warning
RCN Redundant comparison to null in org.globus.cas.impl.databaseAccess.ExternalPolicyEvaluator.getPoliciesForResource(String,String)
SnVI org.globus.cas.CommunityAuthorizationServiceLocator is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.faults.CasFault is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.AddTrustAnchor is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.AddUser is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ArrayOfCasObjectData is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ArrayOfSAMLAuthzQueryType is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ArrayOfString is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.CasObjectDesc is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.CASRPSet is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.CreateGroup is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.CreateObject is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.CreateObjectNamespace is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.CreateServiceType is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.DeleteGroup is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.DeleteObject is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.GetAssertionParam is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.GetGroupMembers is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.List is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ManageObjectGroups is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ManageServiceAction is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ManageServiceActionGroups is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ManageUserGroups is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.NamespaceData is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ObjectData is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ObjectGroupData is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.PolicyData is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.PolicyDetails is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.PolicyResponse is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.SAMLAssertion is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.SAMLAuthzQueryType is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.ServiceTypeData is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.TrustAnchorData is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.UserData is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.UserGroupData is Serializable; consider declaring a serialVersionUID
SnVI org.globus.cas.types.VoidType is Serializable; consider declaring a serialVersionUID

Multithreaded Correctness Warnings

Code  Warning

Malicious Code Vulnerability Warnings

Code  Warning
EI org.globus.cas.impl.client.ClientParams.getResourceActionsMap() may expose internal representation by returning org.globus.cas.impl.client.ClientParams.resActions
EI org.globus.cas.types.ArrayOfCasObjectData.getCasObjects() may expose internal representation by returning org.globus.cas.types.ArrayOfCasObjectData.casObjects
EI org.globus.cas.types.ArrayOfSAMLAuthzQueryType.getSAMLAuthzTypes() may expose internal representation by returning org.globus.cas.types.ArrayOfSAMLAuthzQueryType.SAMLAuthzTypes
EI org.globus.cas.types.ArrayOfString.getStrings() may expose internal representation by returning org.globus.cas.types.ArrayOfString.strings
EI org.globus.cas.types.SAMLAssertion.get_any() may expose internal representation by returning org.globus.cas.types.SAMLAssertion._any
EI org.globus.cas.types.SAMLAuthzQueryType.get_any() may expose internal representation by returning org.globus.cas.types.SAMLAuthzQueryType._any
EI2 org.globus.cas.impl.client.CasClientSetup.<init>(String[],String) may expose internal representation by storing an externally mutable object into org.globus.cas.impl.client.CasClientSetup.args
EI2 org.globus.cas.impl.client.ClientParams.setResourceActionsMap(ResourceActionsMap[]) may expose internal representation by storing an externally mutable object into org.globus.cas.impl.client.ClientParams.resActions
EI2 org.globus.cas.types.ArrayOfCasObjectData.<init>(CasObjectData[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.ArrayOfCasObjectData.casObjects
EI2 org.globus.cas.types.ArrayOfCasObjectData.setCasObjects(CasObjectData[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.ArrayOfCasObjectData.casObjects
EI2 org.globus.cas.types.ArrayOfSAMLAuthzQueryType.<init>(SAMLAuthzQueryType[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.ArrayOfSAMLAuthzQueryType.SAMLAuthzTypes
EI2 org.globus.cas.types.ArrayOfSAMLAuthzQueryType.setSAMLAuthzTypes(SAMLAuthzQueryType[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.ArrayOfSAMLAuthzQueryType.SAMLAuthzTypes
EI2 org.globus.cas.types.ArrayOfString.<init>(String[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.ArrayOfString.strings
EI2 org.globus.cas.types.ArrayOfString.setStrings(String[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.ArrayOfString.strings
EI2 org.globus.cas.types.SAMLAssertion.<init>(org.apache.axis.message.MessageElement[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.SAMLAssertion._any
EI2 org.globus.cas.types.SAMLAssertion.set_any(org.apache.axis.message.MessageElement[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.SAMLAssertion._any
EI2 org.globus.cas.types.SAMLAuthzQueryType.<init>(org.apache.axis.message.MessageElement[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.SAMLAuthzQueryType._any
EI2 org.globus.cas.types.SAMLAuthzQueryType.set_any(org.apache.axis.message.MessageElement[]) may expose internal representation by storing an externally mutable object into org.globus.cas.types.SAMLAuthzQueryType._any
MS org.globus.cas.impl.CasConstants.gpAddEntryPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.gpDeleteEntryPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.gpDeletionPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.grantAllPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.grantPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.namespaceEnrollPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.objectEnrollPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.objectGpCreationPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.queryPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.revokePolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.serviceActionGpCreationPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.serviceTypeCreationPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.trustEnrollPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.unenrollPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.userEnrollPolicy isn't final but should be
MS org.globus.cas.impl.CasConstants.userGpCreationPolicy isn't final but should be

Performance Warnings

Code  Warning
SBSC Method org.globus.cas.impl.client.ClientParams.toString() concatenates strings using + in a loop
SBSC Method org.globus.cas.impl.client.ResourceActionsMap.toString() concatenates strings using + in a loop
UrF Unread field: org.globus.cas.impl.service.TestAssertionGeneration.addGroupEntry
UrF Unread field: org.globus.cas.impl.service.TestAssertionGeneration.createObjGp
UrF Unread field: org.globus.cas.impl.service.TestAssertionGeneration.createServiceActionGp
UrF Unread field: org.globus.cas.impl.service.TestAssertionGeneration.createUserGp
UrF Unread field: org.globus.cas.impl.service.TestAssertionGeneration.enrollAnchor
UrF Unread field: org.globus.cas.impl.service.TestAssertionGeneration.enrollNs
UrF Unread field: org.globus.cas.impl.service.TestAssertionGeneration.enrollObject
UrF Unread field: org.globus.cas.impl.service.TestAssertionGeneration.enrollService
UrF Unread field: org.globus.cas.impl.service.TestAssertionGeneration.enrollUser
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.addGroupEntry
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.createObjGp
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.createServiceActionGp
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.createUserGp
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.deleteGroupEntry
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.deleteGroupId
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.enrollAnchor
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.enrollNs
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.enrollObject
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.enrollService
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.enrollUser
UrF Unread field: org.globus.cas.impl.service.TestGrantUser1.unenrollId
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.addGroupEntry
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.createObjGp
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.createServiceActionGp
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.createUserGp
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.enrollAnchor
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.enrollNs
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.enrollObject
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.enrollService
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.enrollUser
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.groupName
UrF Unread field: org.globus.cas.impl.service.TestGrantUser2.objId
UrF Unread field: org.globus.cas.impl.service.TestSelfEnrollPermissions.addGroupEntry
UrF Unread field: org.globus.cas.impl.service.TestSelfUnenrollPermissions.deleteGroupEntry
UrF Unread field: org.globus.cas.impl.service.TestSelfUnenrollPermissions.deleteGroupId
UrF Unread field: org.globus.cas.impl.service.TestSelfUnenrollPermissions.objId
UrF Unread field: org.globus.cas.impl.service.TestSelfUnenrollPermissions.unenrollId
UrF Unread field: org.globus.cas.utils.TestSetup.testSetup

Details

EI_EXPOSE_REP: Method may expose internal representation by returning reference to mutable object

Returning a reference to a mutable object value stored in one of the object's fields exposes the internal representation of the object.  If instances are accessed by untrusted code, and unchecked changes to the mutable object would compromise security or other important properties, you will need to do something different. Returning a new copy of the object is better approach in many situations.

EI_EXPOSE_REP2: Method may expose internal representation by incorporating reference to mutable object

This code stores a reference to an externally mutable object into the internal representation of the object.  If instances are accessed by untrusted code, and unchecked changes to the mutable object would compromise security or other important properties, you will need to do something different. Storing a copy of the object is better approach in many situations.

MS_SHOULD_BE_FINAL: Field isn't final but should be

A mutable static field could be changed by malicious code or by accident from another package. The field could be made final to avoid this vulnerability.

RCN_REDUNDANT_COMPARISON_TO_NULL: Redundant comparison to null

This method contains a redundant comparison of a reference value to null. Two types of redundant comparison are reported:

  • Both values compared are definitely null
  • One value is definitely null and the other is definitely not null

This particular warning represents two specific kinds of redundant comparisions:

  1. A value was dereferenced, and later explicitly compared to null: this often indicates an error in the method
  2. A literal null value was explicitly compared to null: this may indicate that the method was modified without complete understanding of the invariants of the method

SBSC_USE_STRINGBUFFER_CONCATENATION: Method concatenates strings using + in a loop

The method seems to be building a String using concatenation in a loop. In each iteration, the String is converted to a StringBuffer/StringBuilder, appended to, and converted back to a String. This can lead to a cost quadractic in the number of iterations, as the growing string is recopied in each iteration.

Better performance can be obtained by using a StringBuffer (or StringBuilder in Java 1.5) explicitly.

For example:

  // This is bad
  String s = "";
  for (int i = 0; i < field.length; ++i) {
    s = s + field[i];
  }

  // This is better
  StringBuffer buf = new StringBuffer();
  for (int i = 0; i < field.length; ++i) {
    buf.append(field[i]);
  }
  String s = buf.toString();

SE_NO_SERIALVERSIONID: Class is Serializable, but doesn't define serialVersionUID

This class implements the Serializable interface, but does not define a serialVersionUID field.  A change as simple as adding a reference to a .class object will add synthetic fields to the class, which will unfortunately change the implicit serialVersionUID (e.g., adding a reference to String.class will generate a static field class$java$lang$String). Also, different source code to bytecode compilers may use different naming conventions for synthetic variables generated for references to class objects or inner classes. To ensure interoperability of Serializable across versions, consider adding an explicit serialVersionUID.

URF_UNREAD_FIELD: Unread field

This field is never read.  Consider removing it from the class.