sonarQube扫描bug、漏洞处理汇总

目录

Bugs

Use an "instanceof" comparison instead.

Cast one of the operands of this integer division to a "double"

Remove this throw statement from this finally block.

Remove this return statement from this finally block

A "NullPointerException" could be thrown; "pkList" is nullable here.

Use try-with-resources or close this "ResultSet" in a "finally" clause.

Use "Arrays.toString(array)" instead.

Save and re-use this “Random”.

Either re-interrupt this method or rethrow the "InterruptedException".

Synchronize on a new "Object" instead. 

Replace the call to "Thread.sleep(...)" with a call to "wait(...)"

Use "BigDecimal.valueOf" instead 

Call "Optional#isPresent()" before accessing the value.

Use try-with-resources or close this "PreparedStatement" in a "finally" clause. 

漏洞 

 Make this "public static producer" field final

Use a logger to log this exception

Lower the visibility of this setter or remove it altogether.

Do something with the "boolean" value returned by "delete".

Make this "public static redisTemplate" field final



Bugs

  • Use an "instanceof" comparison instead.

sonarQube扫描bug、漏洞处理汇总

修改为:

sonarQube扫描bug、漏洞处理汇总

 

  • Cast one of the operands of this integer division to a "double"

sonarQube扫描bug、漏洞处理汇总

修改为:

 sonarQube扫描bug、漏洞处理汇总

  • Remove this throw statement from this finally block.

sonarQube扫描bug、漏洞处理汇总

说明:finally块中使用returnbreakthrow等可以抑制trycatch块中抛出的任何未处理的Throwable的传播,修改为:

 sonarQube扫描bug、漏洞处理汇总

  • Remove this return statement from this finally block

sonarQube扫描bug、漏洞处理汇总

说明:因为finally里面写了return语句的时候,就会覆盖掉try代码块里面的return。因为finally是肯定会执行的。例子如下:

sonarQube扫描bug、漏洞处理汇总

上述代码修改为:

sonarQube扫描bug、漏洞处理汇总

  • A "NullPointerException" could be thrown; "pkList" is nullable here.

​​​​​​​sonarQube扫描bug、漏洞处理汇总

增加空值判断,如下所示:

sonarQube扫描bug、漏洞处理汇总

  • Use try-with-resources or close this "ResultSet" in a "finally" clause.

sonarQube扫描bug、漏洞处理汇总

修改为:

sonarQube扫描bug、漏洞处理汇总

或者参考如下:

sonarQube扫描bug、漏洞处理汇总

sonarQube扫描bug、漏洞处理汇总

  • Use "Arrays.toString(array)" instead.

​​​​​​​sonarQube扫描bug、漏洞处理汇总

修改为:

sonarQube扫描bug、漏洞处理汇总

参考如下:

sonarQube扫描bug、漏洞处理汇总

  • Save and re-use this Random.

​​​​​​​sonarQube扫描bug、漏洞处理汇总

说明:这种提示是随机数应该需要重用,然后他给出的参考是这样的

sonarQube扫描bug、漏洞处理汇总

  • Either re-interrupt this method or rethrow the "InterruptedException".

​​​​​​​sonarQube扫描bug、漏洞处理汇总

修改为:

sonarQube扫描bug、漏洞处理汇总

  • Synchronize on a new "Object" instead. 

sonarQube扫描bug、漏洞处理汇总

修改为如下:

sonarQube扫描bug、漏洞处理汇总  

  • Replace the call to "Thread.sleep(...)" with a call to "wait(...)"

​​​​​​​sonarQube扫描bug、漏洞处理汇总

说明:如果在当前线程持有锁时调用Thread.sleep(…),则可能导致性能和可伸缩性问题,甚至更糟,因为持有锁的线程的执行被冻结。最好对monitor对象调用wait(…)来暂时释放锁并允许其他线程运行。修改为如下:

sonarQube扫描bug、漏洞处理汇总

  • Use "BigDecimal.valueOf" instead 

sonarQube扫描bug、漏洞处理汇总

说明:由于浮点不精确,您不太可能从BigDecimal(double)构造函数中获得预期的值。修改为如下:

sonarQube扫描bug、漏洞处理汇总

  • Call "Optional#isPresent()" before accessing the value.

sonarQube扫描bug、漏洞处理汇总

说明:Optional value可以保存值,也可以不保存。可选方法中的值可以使用get()方法访问,但它会抛出一个

如果不存在值,则NoSuchElementException。为了避免异常,应该总是在调用get()之前调用isPresent()方法。

另外,请注意其他方法,如orElse(…)orElseGet(…)orElseThrow(…),可用于指定如何处理空的可选对象。

修改为如下:

sonarQube扫描bug、漏洞处理汇总

  • Use try-with-resources or close this "PreparedStatement" in a "finally" clause. 

sonarQube扫描bug、漏洞处理汇总

修改为如下所示:使用try-with-resources语法

sonarQube扫描bug、漏洞处理汇总

漏洞 

  •  Make this "public static producer" field final

​​​​​​​sonarQube扫描bug、漏洞处理汇总

修改为如下:

sonarQube扫描bug、漏洞处理汇总

  • Use a logger to log this exception

​​​​​​​sonarQube扫描bug、漏洞处理汇总

修改为如下:

sonarQube扫描bug、漏洞处理汇总

  • Lower the visibility of this setter or remove it altogether.

sonarQube扫描bug、漏洞处理汇总

解决方法:去掉枚举中的set方法

  • Do something with the "boolean" value returned by "delete".

​​​​​​​sonarQube扫描bug、漏洞处理汇总

修改为如下:

sonarQube扫描bug、漏洞处理汇总

  • Make this "public static redisTemplate" field final

sonarQube扫描bug、漏洞处理汇总

修改为如下:

sonarQube扫描bug、漏洞处理汇总