FindBugs Report

Project Information

Project: <<unnamed project>>

FindBugs version: 1.0.0-rc1

Code analyzed:

Contents

Summary

Warning Type Number
Correctness Warnings 72
Internationalization Warnings 0
Multithreaded Correctness Warnings 28
Malicious Code Vulnerability Warnings 54
Performance Warnings 22
Style Warnings 21
Total 197

Warnings

Click on a warning row to see full context information.

Correctness Warnings

Code  Warning
DE org.globus.wsrf.impl.security.descriptor.SecurityHelper.parse(String,org.apache.commons.digester.RuleSetBase,String) might ignore java.lang.Exception
Dm org.globus.ant.AntLogger.buildFinished(org.apache.tools.ant.BuildEvent) invokes System.exit(...), which shuts down the entire virtual machine
Dm org.globus.wsrf.client.BaseClient.parse(String[],java.util.Properties) invokes System.exit(...), which shuts down the entire virtual machine
Dm org.globus.wsrf.client.EmbedAssertion.embedAssertion() invokes System.exit(...), which shuts down the entire virtual machine
Dm org.globus.wsrf.client.EmbedAssertion.parse(String[]) invokes System.exit(...), which shuts down the entire virtual machine
Dm org.globus.wsrf.container.ShutdownService$1.run() invokes System.exit(...), which shuts down the entire virtual machine
DP org.globus.wsrf.container.ServiceDispatcher.createServiceClassLoader() creates a org.globus.bootstrap.JarClassLoader classloader, which should be performed within a doPrivileged block
NP Possible null pointer dereference in org.globus.wsrf.jndi.JNDIUtils.initializeFile(org.apache.axis.MessageContext)
RCN Nullcheck at AuthorizationHandler.java:[line 128] of value previously dereferenced at org.globus.wsrf.impl.security.authorization.AuthorizationHandler.invoke(org.apache.axis.MessageContext)
RCN Nullcheck at JNDIUtils.java:[line 360] of value previously dereferenced at org.globus.wsrf.jndi.JNDIUtils.lookup(javax.naming.Context,String,Class)
RCN Nullcheck at XmlPersistenceHelper.java:[line 234] of value previously dereferenced at org.globus.wsrf.utils.XmlPersistenceHelper.store(Object,Object,javax.xml.namespace.QName)
Se Class org.globus.wsrf.impl.security.authorization.AccessControlListPDP defines non-transient non-serializable instance field org.globus.wsrf.impl.security.authorization.AccessControlListPDP.accessList
Se Class org.globus.wsrf.impl.security.authorization.AccessControlListPDP defines non-transient non-serializable instance field org.globus.wsrf.impl.security.authorization.AccessControlListPDP.adminList
Se Class org.globus.wsrf.impl.security.authorization.ContainerChainConfig defines non-transient non-serializable instance field org.globus.wsrf.impl.security.authorization.ContainerChainConfig.msgCtx
Se Class org.globus.wsrf.impl.security.authorization.ContainerPIP defines non-transient non-serializable instance field org.globus.wsrf.impl.security.authorization.ContainerPIP.context
Se Class org.globus.wsrf.impl.security.authorization.HostAuthorization defines non-transient non-serializable instance field org.globus.wsrf.impl.security.authorization.HostAuthorization.expected
Se Class org.globus.wsrf.impl.security.authorization.ResourcePropertiesPDP defines non-transient non-serializable instance field org.globus.wsrf.impl.security.authorization.ResourcePropertiesPDP.getRPAccessConfig
Se Class org.globus.wsrf.impl.security.authorization.ResourcePropertiesPDP defines non-transient non-serializable instance field org.globus.wsrf.impl.security.authorization.ResourcePropertiesPDP.setRPAccessConfig
Se Class org.globus.wsrf.impl.security.authorization.SAMLAuthorizationCallout defines non-transient non-serializable instance field org.globus.wsrf.impl.security.authorization.SAMLAuthorizationCallout.authzPort
Se Class org.globus.wsrf.impl.security.authorization.ServicePropertiesChainConfig defines non-transient non-serializable instance field org.globus.wsrf.impl.security.authorization.ServicePropertiesChainConfig.msgCtx
Se The method writeObject(java.io.ObjectOutputStream) must be private to be invoked in serialization/deserialization of org.globus.wsrf.impl.security.descriptor.ClientSecurityDescriptor
SnVI org.globus.axis.providers.RPCProvider is Serializable; consider declaring a serialVersionUID
SnVI org.globus.ws.enumeration.IndexedObjectFileEnumIterator is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.container.AxisServlet is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.AnyDeserializerFactory is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.AnyListDeserializer is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.AnyListDeserializerFactory is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.AnyListSerializer is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.AnyListSerializerFactory is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.AnySerializer is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.AnySerializerFactory is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.QueryExpressionDeserializer is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.QueryExpressionDeserializerFactory is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.QueryExpressionSerializer is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.QueryExpressionSerializerFactory is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.TopicExpressionDeserializer is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.TopicExpressionDeserializerFactory is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.TopicExpressionSerializer is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.encoding.TopicExpressionSerializerFactory is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.handlers.FaultHandler is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.handlers.MessageLoggingHandler is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.notification.PersistentSubscription is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.notification.SimpleSubscription is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authentication.AuthHandler is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authentication.ClientPropertiesHandler is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authentication.RunAsHandler is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authentication.secureconv.service.AuthenticationServiceHandler is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authentication.transport.AJPTransportSecurityHandler is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authentication.transport.TomcatTransportSecurityHandler is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.AccessControlListPDP is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.AuthorizationEngine is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.AuthorizationHandler is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.ContainerPIP is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.GridMapAuthorization is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.HostAuthorization is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.HostOrSelfAuthorization is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.IdentityAuthorization is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.NoAuthorization is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.ParameterPIP is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.ResourcePropertiesPDP is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.SAMLAuthorizationCallout is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.SAMLAuthzAssertionPDP is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.SAMLAuthzAssertionPIP is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.SelfAuthorization is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.ServicePropertiesChainConfig is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.UsernameAuthorization is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.authorization.X509BootstrapPIP is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.descriptor.ContainerSecurityDescriptor is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.security.descriptor.ServiceSecurityDescriptor is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.SimpleResourceKey is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.impl.SimpleSubscriptionTopicListener is Serializable; consider declaring a serialVersionUID
SnVI org.globus.wsrf.security.authorization.AuthorizationProvider is Serializable; consider declaring a serialVersionUID

Internationalization Warnings

Code  Warning

Multithreaded Correctness Warnings

Code  Warning
DC Possible doublecheck on org.globus.wsrf.impl.security.authentication.wssec.GSSConfig.alreadyInitialized in org.globus.wsrf.impl.security.authentication.wssec.GSSConfig.init()
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.consumerReference; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.creationTime; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.id; locked 83% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.isPaused; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.policy; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.precondition; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.producerHomeLocation; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.producerKey; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.producerReference; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.resourceSecurityDescriptor; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.securityDescriptor; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.selector; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.terminationTime; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.topicExpression; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.notification.PersistentSubscription.useNotify; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.query.QueryMetricsData.successfulQueries; locked 60% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.query.QueryMetricsData.totalQueries; locked 60% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.security.authorization.AccessControlListPDP$AccessControlList.lastModified; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.security.authorization.ResourcePropertiesPDP$AccessConfiguration.lastModified; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.security.descriptor.ContainerSecurityDescriptor.usingDefaultCredential; locked 50% of time
IS2 Inconsistent synchronization of org.globus.wsrf.impl.SingletonResourceHome.singleResource; locked 75% of time
IS2 Inconsistent synchronization of org.globus.wsrf.utils.cache.LinkedNodeList.head; locked 66% of time
IS2 Inconsistent synchronization of org.globus.wsrf.utils.cache.LinkedNodeList.tail; locked 82% of time
IS2 Inconsistent synchronization of org.globus.wsrf.utils.cache.LRUCache.timer; locked 75% of time
NN Naked notify in org.globus.wsrf.impl.work.WorkManagerImpl.processEvent(commonj.work.WorkEvent)
UW Unconditional wait in org.globus.wsrf.client.Subscribe.main(String[])
Wa Wait not in loop in org.globus.wsrf.client.Subscribe.main(String[])

Malicious Code Vulnerability Warnings

Code  Warning
EI org.globus.axis.description.Resources.getContents() may expose internal representation by returning org.globus.axis.description.Resources.contents
EI org.globus.ws.enumeration.IterationResult.getItems() may expose internal representation by returning org.globus.ws.enumeration.IterationResult.items
EI org.globus.wsrf.impl.query.QueryMetricsData.getMetrics() may expose internal representation by returning org.globus.wsrf.impl.query.QueryMetricsData.METRICS
EI org.globus.wsrf.impl.security.authentication.ContextCrypto.getAliasesForDN(String) may expose internal representation by returning org.globus.wsrf.impl.security.authentication.ContextCrypto.ALIASES
EI org.globus.wsrf.impl.security.authentication.encryption.EncryptionCredentials.getCertificates() may expose internal representation by returning org.globus.wsrf.impl.security.authentication.encryption.EncryptionCredentials.certs
EI org.globus.wsrf.impl.security.authentication.wssec.WSSecurityBasicHandler.getHeaders() may expose internal representation by returning org.globus.wsrf.impl.security.authentication.wssec.WSSecurityBasicHandler.HEADERS
EI org.globus.wsrf.impl.SimpleTopicExpressionEvaluator.getDialects() may expose internal representation by returning org.globus.wsrf.impl.SimpleTopicExpressionEvaluator.dialects
EI org.globus.wsrf.impl.XPathExpressionEvaluator.getDialects() may expose internal representation by returning org.globus.wsrf.impl.XPathExpressionEvaluator.DIALECTS
EI org.globus.wsrf.query.targetedXPath.BaseTargetedXPathExpressionEvaluator.getDialects() may expose internal representation by returning org.globus.wsrf.query.targetedXPath.BaseTargetedXPathExpressionEvaluator.DIALECTS
EI org.globus.wsrf.security.authorization.SOAPParameter.getParmeterPath() may expose internal representation by returning org.globus.wsrf.security.authorization.SOAPParameter.parameterPath
EI org.globus.wsrf.utils.Resources.getContents() may expose internal representation by returning org.globus.wsrf.utils.Resources.contents
EI2 org.globus.ws.enumeration.IterationResult.<init>(javax.xml.soap.SOAPElement[],boolean) may expose internal representation by storing an externally mutable object into org.globus.ws.enumeration.IterationResult.items
EI2 org.globus.wsrf.impl.security.authentication.encryption.EncryptionCredentials.<init>(java.security.cert.X509Certificate[]) may expose internal representation by storing an externally mutable object into org.globus.wsrf.impl.security.authentication.encryption.EncryptionCredentials.certs
EI2 org.globus.wsrf.impl.security.authentication.secureconv.SecureConversationMessage.<init>(org.apache.axis.message.MessageElement[]) may expose internal representation by storing an externally mutable object into org.globus.wsrf.impl.security.authentication.secureconv.SecureConversationMessage.anyContent
EI2 org.globus.wsrf.security.authorization.SOAPParameter.<init>(String,String,javax.xml.namespace.QName[]) may expose internal representation by storing an externally mutable object into org.globus.wsrf.security.authorization.SOAPParameter.parameterPath
MS org.globus.axis.configuration.EngineConfigurationFactoryServlet.log isn't final but should be
MS org.globus.wsrf.container.BaseContainerConfig.baseDirectory should be package protected
MS org.globus.wsrf.container.BaseContainerConfig.containerID should be package protected
MS org.globus.wsrf.container.BaseContainerConfig.schemaDirectory should be package protected
MS org.globus.wsrf.container.BaseContainerConfig.serverEngine should be package protected
MS org.globus.wsrf.container.ServiceContainer.containers should be both final and package protected
MS org.globus.wsrf.container.ServiceThread.CONTENT_LENGTH should be package protected
MS org.globus.wsrf.container.ServiceThread.HTML_MIME_STUFF should be package protected
MS org.globus.wsrf.container.ServiceThread.HTTP_10 should be package protected
MS org.globus.wsrf.container.ServiceThread.HTTP_11 should be package protected
MS org.globus.wsrf.container.ServiceThread.JAR_MIME_STUFF should be package protected
MS org.globus.wsrf.container.ServiceThread.JNLP_MIME_STUFF should be package protected
MS org.globus.wsrf.container.ServiceThread.SEPARATOR should be package protected
MS org.globus.wsrf.container.ServiceThread.UNAUTH should be package protected
MS org.globus.wsrf.container.ServiceThread.XML_MIME_STUFF should be package protected
MS org.globus.wsrf.impl.ResourceSweeper.logger isn't final but should be
MS org.globus.wsrf.impl.security.authentication.encryption.GssEncryptedSOAPEnvelopeBuilder.crypto isn't final but should be
MS org.globus.wsrf.impl.security.authentication.encryption.X509WSEncryptedSOAPEnvelopeBuilder.crypto isn't final but should be
MS org.globus.wsrf.impl.security.authentication.secureconv.EncryptHandler.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authentication.secureconv.SecContextHandler.log isn't final but should be
MS org.globus.wsrf.impl.security.authentication.secureconv.SignHandler.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authentication.secureconv.SignHandler.log isn't final but should be
MS org.globus.wsrf.impl.security.authentication.securemsg.X509EncryptHandler.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authentication.securemsg.X509SignHandler.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authentication.SecurityPolicyHandler.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authentication.signature.X509WSSignedSOAPEnvelopeBuilder.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authentication.UsernameHandler.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authentication.wssec.ReplayAttackFilter.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authentication.wssec.WSSecurityEngine.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authorization.ContainerPIP.MESSAGE_CTX isn't final but should be
MS org.globus.wsrf.impl.security.authorization.handlers.SAMLAuthzAssertionHandler.i18n isn't final but should be
MS org.globus.wsrf.impl.security.authorization.UsernameTokenCallbackHandler.PROMPT_CREATED isn't final but should be
MS org.globus.wsrf.impl.security.authorization.UsernameTokenCallbackHandler.PROMPT_DIGEST isn't final but should be
MS org.globus.wsrf.impl.security.authorization.UsernameTokenCallbackHandler.PROMPT_NONCE isn't final but should be
MS org.globus.wsrf.impl.security.descriptor.ContainerSecurityDescriptor.i18n isn't final but should be
MS org.globus.wsrf.impl.security.descriptor.SecurityDescriptor.i18n isn't final but should be
MS org.globus.wsrf.impl.security.descriptor.SecurityHelper.i18n isn't final but should be
MS org.globus.wsrf.jndi.BasicBeanFactory.i18n isn't final but should be
MS org.globus.wsrf.tools.wsdl.WSDL2Java.options should be package protected

Performance Warnings

Code  Warning
Dm org.globus.wsrf.container.ServiceThread.handleOutOfMemoryError() forces garbage collection; extremely dubious except in benchmarking code
Dm org.globus.wsrf.impl.security.authorization.SAMLAuthorizationCallout.initializeParam() invokes dubious Boolean constructor; use Boolean.valueOf(...) instead
SBSC Method org.globus.wsrf.client.BaseClient.parse(String[],java.util.Properties) concatenates strings using + in a loop
SBSC Method org.globus.wsrf.impl.security.authorization.SAMLAuthorizationCallout.getActions(org.globus.security.authorization.EntityAttributes,org.globus.security.authorization.EntityAttributes) concatenates strings using + in a loop
SBSC Method org.globus.wsrf.security.authorization.SOAPParameter.toString() concatenates strings using + in a loop
SBSC Method org.globus.wsrf.tools.wsdd.WSDDEditor.fixEolError(String) concatenates strings using + in a loop
SIC Should org.globus.wsrf.impl.security.descriptor.ServiceSecurityHelper$SecurityDescriptorData be a _static_ inner class?
UrF Unread field: org.globus.wsrf.config.ContainerConfig.logger
UrF Unread field: org.globus.wsrf.container.GSIServiceContainer.logger
UrF Unread field: org.globus.wsrf.impl.notification.ClientNotificationConsumerManager.logger
UrF Unread field: org.globus.wsrf.impl.notification.NotificationConsumerHome.logger
UrF Unread field: org.globus.wsrf.impl.notification.PauseSubscriptionProvider.logger
UrF Unread field: org.globus.wsrf.impl.notification.ResumeSubscriptionProvider.logger
UrF Unread field: org.globus.wsrf.impl.notification.ServerNotificationConsumerManager.logger
UrF Unread field: org.globus.wsrf.impl.notification.SubscribeProvider.logger
UrF Unread field: org.globus.wsrf.impl.properties.QueryResourcePropertiesProvider.logger
UrF Unread field: org.globus.wsrf.impl.properties.SetResourcePropertiesProvider.logger
UrF Unread field: org.globus.wsrf.impl.ResourceHomeImpl.logger
UrF Unread field: org.globus.wsrf.impl.security.authentication.secureconv.Authenticator.logger
UrF Unread field: org.globus.wsrf.query.targetedXPath.BaseTargetedXPathExpressionEvaluator.logger
UrF Unread field: org.globus.wsrf.utils.AddressingUtils.logger
UrF Unread field: org.globus.wsrf.utils.AnyHelper.logger

Style Warnings

Code  Warning
DB Method org.globus.ant.AntLogger.messageLogged(org.apache.tools.ant.BuildEvent) uses the same code for two branches
DB Method org.globus.wsrf.utils.FaultHelper.printStackTrace(Throwable) uses the same code for two branches
DLS Dead store to resource in method org.globus.ws.enumeration.EnumProvider.releaseOp(org.xmlsoap.schemas.ws._2004._09.enumeration.Release)
DLS Dead store to subject in method org.globus.wsrf.container.GSIServiceDispatcher.setupThreadPool()
DLS Dead store to $l7 in method org.globus.wsrf.impl.properties.SetResourcePropertiesProvider.setResourceProperties(org.oasis.wsrf.properties.SetResourceProperties_Element)
DLS Dead store to $l4 in method org.globus.wsrf.impl.security.authentication.wssec.WSSecurityEngine.handleUsernameElement(org.w3c.dom.Element,javax.xml.rpc.handler.MessageContext)
DLS Dead store to msg in method org.globus.wsrf.impl.security.authentication.wssec.WSSecurityException.getMessage(int,String,Object[])
DLS Dead store to $l12 in method org.globus.wsrf.impl.security.authorization.SAMLAuthorizationCallout.compareSubject(org.opensaml.SAMLSubject,org.opensaml.SAMLSubject)
DLS Dead store to $l4 in method org.globus.wsrf.impl.security.descriptor.ContainerSecurityDescriptor.getContainerPrincipalAttribute(org.globus.security.authorization.EntityAttributes)
Nm The class name org.globus.wsrf.jndi.javaURLContextFactory doesn't start with an upper case letter
NP Load of known null value in org.globus.wsrf.impl.ReflectionResourceProperty.toElementSimple()
NP Load of known null value in org.globus.wsrf.impl.ReflectionResourceProperty.toSOAPElementSimple()
PS Class org.globus.wsrf.container.Lock exposes synchronization and semaphores in its public interface.
PS Class org.globus.wsrf.container.Semaphore exposes synchronization and semaphores in its public interface.
PS Class org.globus.wsrf.container.ServiceThread exposes synchronization and semaphores in its public interface.
PS Class org.globus.wsrf.container.ServiceThreadPool exposes synchronization and semaphores in its public interface.
REC Method org.globus.ws.enumeration.client.Enumerate.main(String[]) catches Exception, but Exception is not thrown in the try block and RuntimeException is not explicitly caught
REC Method org.globus.wsrf.container.ServiceDispatcher.clearSoftCache(Class,String) catches Exception, but Exception is not thrown in the try block and RuntimeException is not explicitly caught
REC Method org.globus.wsrf.impl.security.authentication.secureconv.service.AuthenticationServiceImpl.requestSecurityToken(org.globus.ws.trust.RequestSecurityTokenType) catches Exception, but Exception is not thrown in the try block and RuntimeException is not explicitly caught
SF Switch statement found in org.globus.wsrf.container.ServiceThread.processReloadState() where one case falls thru to the next case
SF Switch statement found in org.globus.wsrf.tools.wsdd.WSDDEditor.processArguments(String[]) where one case falls thru to the next case

Details

DB_DUPLICATE_BRANCHES: Method uses the same code for two branches

This method uses the same code to implement two branches of a conditional branch. Check to ensure that this isn't a coding mistake.

DC_DOUBLECHECK: Possible double check of field

This method may contain an instance of double-checked locking.  This idiom is not correct according to the semantics of the Java memory model.  For more information, see the web page http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html.

DE_MIGHT_IGNORE: Method might ignore exception

This method might ignore an exception.  In general, exceptions should be handled or reported in some way, or they should be thrown out of the method.

DLS_DEAD_LOCAL_STORE: Dead store to local variable

This instruction assigns a value to a local variable, but the value is not read by any subsequent instruction. Often, this indicates an error, because the value computed is never used.

Note that Sun's javac compiler often generates dead stores for final local variables. Because FindBugs is a bytecode-based tool, there is no easy way to eliminate these false positives.

DM_GC: Explicit garbage collection; extremely dubious except in benchmarking code

Code explicitly invokes garbage collection. Except for specific use in benchmarking, this is very dubious.

In the past, situations where people have explicitly invoked the garbage collector in routines such as close or finalize methods has led to huge performance black holes. Garbage collection can be expensive. Any situation that forces hundreds or thousands of garbage collections will bring the machine to a crawl.

DM_BOOLEAN_CTOR: Method invokes dubious Boolean constructor; use Boolean.valueOf(...) instead

Creating new instances of java.lang.Boolean wastes memory, since Boolean objects are immutable and there are only two useful values of this type.  Use the Boolean.valueOf() method to create Boolean objects instead.

DM_EXIT: Method invokes System.exit(...)

Invoking System.exit shuts down the entire Java virtual machine. This should only been done when it is appropriate. Such calls make it hard or impossible for your code to be invoked by other code. Consider throwing a RuntimeException instead.

DP_CREATE_CLASSLOADER_INSIDE_DO_PRIVILEDGED: Classloaders should only be created inside doPrivileged block

This code creates a classloader, which requires a security manager. If this code will be granted security permissions, but might be invoked by code that does not have security permissions, then the classloader creation needs to occur inside a doPrivileged block.

EI_EXPOSE_REP: Method may expose internal representation by returning reference to mutable object

Returning a reference to a mutable object value stored in one of the object's fields exposes the internal representation of the object.  If instances are accessed by untrusted code, and unchecked changes to the mutable object would compromise security or other important properties, you will need to do something different. Returning a new copy of the object is better approach in many situations.

EI_EXPOSE_REP2: Method may expose internal representation by incorporating reference to mutable object

This code stores a reference to an externally mutable object into the internal representation of the object.  If instances are accessed by untrusted code, and unchecked changes to the mutable object would compromise security or other important properties, you will need to do something different. Storing a copy of the object is better approach in many situations.

IS2_INCONSISTENT_SYNC: Inconsistent synchronization

The fields of this class appear to be accessed inconsistently with respect to synchronization.  This bug report indicates that the bug pattern detector judged that

  1. The class contains a mix of locked and unlocked accesses,
  2. At least one locked access was performed by one of the class's own methods, and
  3. The number of unsynchronized field accesses (reads and writes) was no more than one third of all accesses, with writes being weighed twice as high as reads

A typical bug matching this bug pattern is forgetting to synchronize one of the methods in a class that is intended to be thread-safe.

You can select the nodes labeled "Unsynchronized access" to show the code locations where the detector believed that a field was accessed without synchronization.

Note that there are various sources of inaccuracy in this detector; for example, the detector cannot statically detect all situations in which a lock is held.  Also, even when the detector is accurate in distinguishing locked vs. unlocked accesses, the code in question may still be correct.

This description refers to the "IS2" version of the pattern detector, which has more accurate ways of detecting locked vs. unlocked accesses than the older "IS" detector.

MS_SHOULD_BE_FINAL: Field isn't final but should be

A mutable static field could be changed by malicious code or by accident from another package. The field could be made final to avoid this vulnerability.

MS_FINAL_PKGPROTECT: Field should be both final and package protected

A mutable static field could be changed by malicious code or by accident from another package. The field could be made package protected and/or made final to avoid this vulnerability.

MS_PKGPROTECT: Field should be package protected

A mutable static field could be changed by malicious code or by accident. The field could be made package protected to avoid this vulnerability.

NM_CLASS_NAMING_CONVENTION: Class names should start with an upper case letter

Class names should be nouns, in mixed case with the first letter of each internal word capitalized. Try to keep your class names simple and descriptive. Use whole words-avoid acronyms and abbreviations (unless the abbreviation is much more widely used than the long form, such as URL or HTML).

NN_NAKED_NOTIFY: Naked notify in method

A call to notify() or notifyAll() was made without any (apparent) accompanying modification to mutable object state.  In general, calling a notify method on a monitor is done because some condition another thread is waiting for has become true.  However, for the condition to be meaningful, it must involve a heap object that is visible to both threads.

This bug does not necessarily indicate an error, since the change to mutable object state may have taken place in a method which then called the method containing the notification.

NP_LOAD_OF_KNOWN_NULL_VALUE: Load of known null value

The variable referenced at this point is known to be null due to an earlier check against null. Although this is valid, it might be a mistake (perhaps you intended to refer to a different variable, or perhaps the earlier check to see if the variable is null should have been a check to see if it was nonnull.

NP_NULL_ON_SOME_PATH: Possible null pointer dereference in method

A reference value dereferenced here might be null at runtime.  This may lead to a NullPointerException when the code is executed.

PS_PUBLIC_SEMAPHORES: Class exposes synchronization and semaphores in its public interface.

This class uses synchronization along with wait(), notify() or notifyAll() on itself (the this reference). Client classes that use this class, may, in addition, use an instance of this class as a synchronizing object. Because two classes are using the same object for synchronization, Multithread correctness is suspect. You should not synchronize nor call semaphore methods on a public reference. Consider using a internal private member variable to control synchronization.

RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE: Nullcheck of value previously dereferenced

A value is checked here to see whether it is null, but this value can't be null because it was previously dereferenced and if it were null a null pointer exception would have occurred at the earlier dereference. Essentially, this code and the previous dereference disagree as to whether this value is allowed to be null. Either the check is redundant or the previous dereference is erroneous.

REC_CATCH_EXCEPTION: java.lang.Exception is caught when Exception is not thrown

This method uses a try-catch block that catches Exception objects, but Exception is not thrown within the try block, and RuntimeException is not explicitly caught. It is a common bug pattern to say try { ... } catch (Exception e) { something } as a shorthand for catching a number of types of exception each of whose catch blocks is identical, but this construct also accidentally catches RuntimeException as well, masking potential bugs.

SBSC_USE_STRINGBUFFER_CONCATENATION: Method concatenates strings using + in a loop

The method seems to be building a String using concatenation in a loop. In each iteration, the String is converted to a StringBuffer/StringBuilder, appended to, and converted back to a String. This can lead to a cost quadratic in the number of iterations, as the growing string is recopied in each iteration.

Better performance can be obtained by using a StringBuffer (or StringBuilder in Java 1.5) explicitly.

For example:

  // This is bad
  String s = "";
  for (int i = 0; i < field.length; ++i) {
    s = s + field[i];
  }

  // This is better
  StringBuffer buf = new StringBuffer();
  for (int i = 0; i < field.length; ++i) {
    buf.append(field[i]);
  }
  String s = buf.toString();

SE_METHOD_MUST_BE_PRIVATE: Method must be private in order for serialization to work

This class implements the Serializable interface, and defines a method for custom serialization/deserialization. But since that method isn't declared private, it will be silently ignored by the serialization/deserialization API.

SE_BAD_FIELD: Non-transient non-serializable instance field in serializable class

This Serializable class defines a non-primitive instance field which is neither transient, Serializable, or java.lang.Object, and does not appear to implement the Externalizable interface or the readObject() and writeObject() methods.  Objects of this class will not be deserialized correctly if a non-Serializable object is stored in this field.

SF_SWITCH_FALLTHROUGH: Switch statement found where one case falls thru to the next case

This method contains a switch statement where one case branch will fall thru to the next case. Usually you need to end this case with a break or return.

SIC_INNER_SHOULD_BE_STATIC: Should be a static inner class

This class is an inner class, but does not use its embedded reference to the object which created it.  This reference makes the instances of the class larger, and may keep the reference to the creator object alive longer than necessary.  If possible, the class should be be made static.

SE_NO_SERIALVERSIONID: Class is Serializable, but doesn't define serialVersionUID

This class implements the Serializable interface, but does not define a serialVersionUID field.  A change as simple as adding a reference to a .class object will add synthetic fields to the class, which will unfortunately change the implicit serialVersionUID (e.g., adding a reference to String.class will generate a static field class$java$lang$String). Also, different source code to bytecode compilers may use different naming conventions for synthetic variables generated for references to class objects or inner classes. To ensure interoperability of Serializable across versions, consider adding an explicit serialVersionUID.

URF_UNREAD_FIELD: Unread field

This field is never read.  Consider removing it from the class.

UW_UNCOND_WAIT: Unconditional wait in method

This method contains a call to java.lang.Object.wait() which is not guarded by conditional control flow.  If the condition that the method intends to wait for has already happened, the thread could wait indefinitely.

WA_NOT_IN_LOOP: Wait not in loop in method

This method contains a call to java.lang.Object.wait() which is not in a loop.  If the monitor is used for multiple conditions, the condition the caller intended to wait for might not be the one that actually occurred.