sonarQube扫描bug、漏洞处理汇总
目录
Use an "instanceof" comparison instead.
Cast one of the operands of this integer division to a "double"
Remove this throw statement from this finally block.
Remove this return statement from this finally block
A "NullPointerException" could be thrown; "pkList" is nullable here.
Use try-with-resources or close this "ResultSet" in a "finally" clause.
Use "Arrays.toString(array)" instead.
Save and re-use this “Random”.
Either re-interrupt this method or rethrow the "InterruptedException".
Synchronize on a new "Object" instead.
Replace the call to "Thread.sleep(...)" with a call to "wait(...)"
Use "BigDecimal.valueOf" instead
Call "Optional#isPresent()" before accessing the value.
Use try-with-resources or close this "PreparedStatement" in a "finally" clause.
Make this "public static producer" field final
Use a logger to log this exception
Lower the visibility of this setter or remove it altogether.
Do something with the "boolean" value returned by "delete".
Make this "public static redisTemplate" field final
Bugs
-
Use an "instanceof" comparison instead.
修改为:
-
Cast one of the operands of this integer division to a "double"
修改为:
-
Remove this throw statement from this finally block.
说明:在finally块中使用return、break、throw等可以抑制try或catch块中抛出的任何未处理的Throwable的传播,修改为:
-
Remove this return statement from this finally block
说明:因为finally里面写了return语句的时候,就会覆盖掉try代码块里面的return。因为finally是肯定会执行的。例子如下:
上述代码修改为:
-
A "NullPointerException" could be thrown; "pkList" is nullable here.
增加空值判断,如下所示:
-
Use try-with-resources or close this "ResultSet" in a "finally" clause.
修改为:
或者参考如下:
-
Use "Arrays.toString(array)" instead.
修改为:
参考如下:
-
Save and re-use this “Random”.
说明:这种提示是随机数应该需要重用,然后他给出的参考是这样的
-
Either re-interrupt this method or rethrow the "InterruptedException".
修改为:
-
Synchronize on a new "Object" instead.
修改为如下:
-
Replace the call to "Thread.sleep(...)" with a call to "wait(...)"
说明:如果在当前线程持有锁时调用Thread.sleep(…),则可能导致性能和可伸缩性问题,甚至更糟,因为持有锁的线程的执行被冻结。最好对monitor对象调用wait(…)来暂时释放锁并允许其他线程运行。修改为如下:
-
Use "BigDecimal.valueOf" instead
说明:由于浮点不精确,您不太可能从BigDecimal(double)构造函数中获得预期的值。修改为如下:
-
Call "Optional#isPresent()" before accessing the value.
说明:Optional value可以保存值,也可以不保存。可选方法中的值可以使用get()方法访问,但它会抛出一个
如果不存在值,则NoSuchElementException。为了避免异常,应该总是在调用get()之前调用isPresent()方法。
另外,请注意其他方法,如orElse(…)、orElseGet(…)或orElseThrow(…),可用于指定如何处理空的可选对象。
修改为如下:
-
Use try-with-resources or close this "PreparedStatement" in a "finally" clause.
修改为如下所示:使用try-with-resources语法
漏洞
-
Make this "public static producer" field final
修改为如下:
-
Use a logger to log this exception
修改为如下:
-
Lower the visibility of this setter or remove it altogether.
解决方法:去掉枚举中的set方法
-
Do something with the "boolean" value returned by "delete".
修改为如下:
-
Make this "public static redisTemplate" field final
修改为如下: