Mailing-List: contact notifications-help@ofbiz.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ofbiz.apache.org
Date: Wed, 13 Sep 2017 11:04:01 +0000 (UTC)
From: "Dennis Balkir (JIRA)" <jira@apache.org>
To: notifications@ofbiz.apache.org
Message-ID: <JIRA.13101923.1505300292000.100571.1505300641486@Atlassian.JIRA>
In-Reply-To: <JIRA.13101923.1505300292000@Atlassian.JIRA>
References: <JIRA.13101923.1505300292000@Atlassian.JIRA> <JIRA.13101923.1505300292412@jira-lw-us.apache.org>
Subject: [jira] [Updated] (OFBIZ-9714) [FB] Package
 org.apache.ofbiz.service.rmi.socket.ssl
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Wed, 13 Sep 2017 11:04:09 -0000


     [ https://issues.apache.org/jira/browse/OFBIZ-9714?page=3Dcom.atlassia=
n.jira.plugin.system.issuetabpanels:all-tabpanel ]

Dennis Balkir updated OFBIZ-9714:
---------------------------------
    Attachment: OFBIZ-9714_org.apache.ofbiz.service.rmi.socket.ssl_bugfixes=
.patch

class SSLClientSocketFactory:
- Line 38: it=E2=80=99s not necessary for the class to implement serialVeri=
sonUID

class SSLServerSocketFactory:
- Line 43: it=E2=80=99s not necessary for the class to implement serialVeri=
sonUID
- Line 74 and following: changed the declaration of the FileInputStream
- Line 117: changed the code to reduce the possibility of errors


> [FB] Package org.apache.ofbiz.service.rmi.socket.ssl
> ----------------------------------------------------
>
>                 Key: OFBIZ-9714
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-9714
>             Project: OFBiz
>          Issue Type: Sub-task
>          Components: framework
>    Affects Versions: Trunk
>            Reporter: Dennis Balkir
>            Priority: Minor
>         Attachments: OFBIZ-9714_org.apache.ofbiz.service.rmi.socket.ssl_b=
ugfixes.patch
>
>
> - SSLClientSocketFactory.java:37, SE_NO_SERIALVERSIONID
> SnVI: org.apache.ofbiz.service.rmi.socket.ssl.SSLClientSocketFactory is S=
erializable; consider declaring a serialVersionUID
> This class implements the Serializable interface, but does not define a s=
erialVersionUID field.  A change as simple as adding a reference to a .clas=
s object will add synthetic fields to the class, which will unfortunately c=
hange the implicit serialVersionUID (e.g., adding a reference to String.cla=
ss will generate a static field class$java$lang$String). Also, different so=
urce code to bytecode compilers may use different naming conventions for sy=
nthetic variables generated for references to class objects or inner classe=
s. To ensure interoperability of Serializable across versions, consider add=
ing an explicit serialVersionUID.
> - SSLServerSocketFactory.java:43, SE_NO_SERIALVERSIONID
> SnVI: org.apache.ofbiz.service.rmi.socket.ssl.SSLServerSocketFactory is S=
erializable; consider declaring a serialVersionUID
> This class implements the Serializable interface, but does not define a s=
erialVersionUID field.  A change as simple as adding a reference to a .clas=
s object will add synthetic fields to the class, which will unfortunately c=
hange the implicit serialVersionUID (e.g., adding a reference to String.cla=
ss will generate a static field class$java$lang$String). Also, different so=
urce code to bytecode compilers may use different naming conventions for sy=
nthetic variables generated for references to class objects or inner classe=
s. To ensure interoperability of Serializable across versions, consider add=
ing an explicit serialVersionUID.
> - SSLServerSocketFactory.java:76, OS_OPEN_STREAM
> OS: org.apache.ofbiz.service.rmi.socket.ssl.SSLServerSocketFactory.create=
ServerSocket(int) may fail to close stream
> The method creates an IO stream object, does not assign it to any fields,=
 pass it to other methods that might close it, or return it, and does not a=
ppear to close the stream on all paths out of the method.  This may result =
in a file descriptor leak.  It is generally a good idea to use a finally bl=
ock to ensure that streams are closed.
> - SSLServerSocketFactory.java:76, OBL_UNSATISFIED_OBLIGATION
> OBL: org.apache.ofbiz.service.rmi.socket.ssl.SSLServerSocketFactory.creat=
eServerSocket(int) may fail to clean up java.io.InputStream
> This method may fail to clean up (close, dispose of) a stream, database o=
bject, or other resource requiring an explicit cleanup operation.
> In general, if a method opens a stream or other resource, the method shou=
ld use a try/finally block to ensure that the stream or resource is cleaned=
 up before the method returns.
> This bug pattern is essentially the same as the OS_OPEN_STREAM and ODR_OP=
EN_DATABASE_RESOURCE bug patterns, but is based on a different (and hopeful=
ly better) static analysis technique. We are interested is getting feedback=
 about the usefulness of this bug pattern. To send feedback, either:
> send email to findbugs@cs.umd.edu
> file a bug report: http://findbugs.sourceforge.net/reportingBugs.html
> In particular, the false-positive suppression heuristics for this bug pat=
tern have not been extensively tuned, so reports about false positives are =
helpful to us.
> See Weimer and Necula, Finding and Preventing Run-Time Error Handling Mis=
takes, for a description of the analysis technique.
> - SSLServerSocketFactory.java:111, BC_UNCONFIRMED_CAST_OF_RETURN_VALUE
> BC: Unchecked/unconfirmed cast from java.net.ServerSocket to javax.net.ss=
l.SSLServerSocket of return value in org.apache.ofbiz.service.rmi.socket.ss=
l.SSLServerSocketFactory.createServerSocket(int)
> This code performs an unchecked cast of the return value of a method. The=
 code might be calling the method in such a way that the cast is guaranteed=
 to be safe, but FindBugs is unable to verify that the cast is safe. Check =
that your program logic ensures that this cast will not fail.


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)