Conversation
…loses
Class.newInstance() is replaced with getDeclaredConstructor().newInstance()
at every call site (20): all are already inside a catch (Exception) or
catch (Throwable), or declared throws Exception, so the extra checked
NoSuchMethodException needs no new handling.
new Integer/Long/Boolean/Double/Float/Character(String) become valueOf/
parseX (19 sites); new String(x) becomes x.
SQLUtil.closeQuietly(Connection/Statement/ResultSet), deprecated in favour
of IOUtil.quietClose, is replaced at its 23 call sites, including its own
internal use. IOUtil.quietClose(Connection) was missing the isClosed()
check SQLUtil.closeQuietly(Connection) has, so it called close() on an
already-closed connection where the old code did not; two tests using a
strict-sequence mock caught it. IOUtil.quietClose(Connection) now checks
isClosed() first, matching what it replaces.
Plexus IOUtil.close(Closeable) ("deprecated: use try-with-resources
instead") is replaced by try-with-resources at its 3 call sites in the
maven plugin.
XMLConfiguration.validate and GroovyDataProvider no longer ignore the
return value of mkdir()/createNewFile(): a real failure now surfaces
through the existing IOException handling instead of being silently
masked by the following canWrite() check.
Small ones: PrettyStringBuilder iterates entrySet() instead of keySet()
followed by get(); StringUtil.isEmpty and an XSD annotation check use
isEmpty() instead of comparing to ""; a missing space in a concatenated
message and a stray comma in a @PARAM tag are fixed.
vharseko
added
java
vharseko
added
dbcommon
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes ~68 of the open
note-severity CodeQL alerts (no security rating) that are safe, mechanical fixes:java/deprecated-call(Class.newInstance, SQLUtil.closeQuietly, plexus IOUtil.close),java/inefficient-boxed-constructor,java/inefficient-string-constructor,java/ignored-error-status-of-call,java/inefficient-key-set-iterator,java/inefficient-empty-string-test,java/missing-space-in-concatenation,java/unknown-javadoc-parameter.Class.newInstance() — 20 sites, 16 files
Replaced with
getDeclaredConstructor().newInstance(), which lets the constructor's own checked exceptions surface viaInvocationTargetExceptioninstead of being silently mixed intoInstantiationException/IllegalAccessException. Checked every site first: each is already inside acatch (Exception …)/catch (Throwable …)or declaredthrows Exception, so the extra checkedNoSuchMethodExceptionneeds no new handling anywhere.Boxed constructors — 19 sites
new Integer/Long/Boolean/Double/Float/Character(String)→valueOf/parseXinAttributeTypeUtil,RandomGenerator,SQLUtil;new String(x)→xinAttributeTypeUtil.SQLUtil.string2Timestamp/string2DateuseLong.parseLong(a primitive is what theDate/Timestampconstructor needs, so no boxing round-trip at all).Deprecated closes — 26 sites
SQLUtil.closeQuietly(Connection/Statement/ResultSet)(deprecated in favour ofIOUtil.quietClose) is replaced at its 23 call sites, including its own 6 internal uses.IOUtil.quietClose(Connection)did not checkisClosed()before callingclose(), unlike theSQLUtil.closeQuietly(Connection)it replaces. Harmless against a real JDBC driver (Connection.close()on an already-closed connection is a spec-mandated no-op), but two tests using a strict-call-sequence mock (DatabaseConnectionTest.testDispose,SQLUtilTests.quietConnectionClose) caught the difference immediately.IOUtil.quietClose(Connection)now checksisClosed()first, matching what it replaces and what its own javadoc promises.IOUtil.close(Closeable)— its javadoc says "deprecated: use try-with-resources instead" — is replaced by try-with-resources at its 3 call sites in the maven plugin.ignored-error-status-of-call — 3 sites
XMLConfiguration.validate:getParentFile().mkdir()'s return value is checked now, distinguishing "the directory already existed" from a real failure.GroovyDataProvider(×2): acreateNewFile()failure now throws into the existingcatch (IOException)instead of being silently swallowed and only surfacing indirectly (and confusingly) through the followingcanWrite()check.Small mechanical ones
PrettyStringBuilder:map.keySet().iterator()+map.get(key)→map.entrySet().iterator().StringUtil.isEmptyand an XSD annotation check:"".equals(x)/x.equals("")→x.isEmpty(). A missing space in a concatenated log message (ActiveDirectoryChangeLogSyncStrategy) and a stray comma in a@paramjavadoc tag (MultiOpTests) are fixed.Tests
No new tests: these are mechanical replacements with identical behaviour (verified case by case for
newInstance), except theIOUtil.quietClose(Connection)fix, which is proven by the two existing tests that caught the regression and now pass.Local runs of all 11 touched modules, all green: connector-framework 186, dbcommon 86, connector-test-common 5, connector-framework-internal 469 (2 skipped, same as on master), connector-framework-osgi (compiles), connector-framework-contract 43, maven-plugin (compiles), connector-framework-server 29, databasetable-connector 78, ldap-connector 159 (embedded OpenDJ), xml-connector 81.
Left open on purpose
java/missing-override-annotation(1327 — mechanically safe but would touch ~200 files and conflict with the six other open CodeQL PRs),java/deprecated-callonMessagesUtil.*Legacy(67 — the framework's own deprecated API, its only path for script arguments today),java/uncaught-number-format-exception(62 — needs a per-site judgment call, not mechanical),java/unused-parameter/java/constants-only-interface/java/jdk-internal-api-access(public API or no JDK alternative),java/chained-type-tests(needs an actual refactor),java/call-to-object-tostring/java/local-shadows-field/java/confusing-method-signature(judgment calls, not mechanics).