SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 156

changes.mady.by.user Will Snavely

Saved on

compared with

New Version 157

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: deprecated finalizers

...

  • Use of locks or other synchronization-based mechanisms within a finalizer can cause deadlock or starvation. This possibility arises because neither the invocation order nor the specific executing thread or threads for finalizers can be guaranteed or controlled.

Object finalizers have also been deprecated since Java 9. See MET02-J. Do not use deprecated or obsolete classes or methods for more information.

Because of these problems, finalizers must not be used in new classes.

...

This noncompliant code example uses the System.runFinalizersOnExit() method to simulate a garbage-collection run. Note that this method is deprecated because of thread-safety issues; see MET02-J. Do not use deprecated or obsolete classes or methods.

According to the Java API [API 2014] class System, runFinalizersOnExit() method documentation,

...

Improper use of finalizers can result in resurrection of garbage-collection-ready objects and result in denial-of-service vulnerabilities.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

MET12-J

Medium

Probable

Medium

P8

L2

Automated Detection

Tool
Version
Checker
Description
CodeSonar4.2FB.BAD_PRACTICE.FI_EMPTY
FB.BAD_PRACTICE.FI_EXPLICIT_INVOCATION
FB.BAD_PRACTICE.FI_FINALIZER_NULLS_FIELDS
FB.BAD_PRACTICE.FI_FINALIZER_ONLY_NULLS_FIELDS
FB.BAD_PRACTICE.FI_MISSING_SUPER_CALL
FB.BAD_PRACTICE.FI_NULLIFY_SUPER
FB.MALICIOUS_CODE.FI_PUBLIC_SHOULD_BE_PROTECTED
FB.BAD_PRACTICE.FI_USELESS

Empty finalizer should be deleted
Explicit invocation of finalizer
Finalizer nulls fields
Finalizer nulls fields
Finalizer does not call superclass finalizer
Finalizer nullifies superclass finalizer
Finalizer should be protected, not public
Finalizer does nothing but call superclass finalizer

Coverity7.5

CALL_SUPER
DC.THREADING
FB.FI_EMPTY
FB.FI_EXPLICIT_INVOCATION
FB.FI_FINALIZER_NULLS_FIELDS
FB.FI_FINALIZER_ONLY_NULLS_FIELDS
FB.FI_MISSING_SUPER_CALL
FB.FI_NULLIFY_SUPER
FB.FI_USELESS
FB.FI_PUBLIC_SHOULD_BE_ PROTECTED

Implemented
Parasoft Jtest
Include Page
java:
Parasoft_V
java:
Parasoft_V
EJB.MNDF, GC.FCF, GC.FM, GC.IFF, GC.NCF, PB.API.OF,UC.EF, UC.FCSF
 

SonarQube Java Plugin
Include Page
SonarQube Java Plugin_V
SonarQube Java Plugin_V
ObjectFinalizeOverridenCheck,
ObjectFinalizeCheck,
S1174,
S2151,
ObjectFinalizeOverridenCallsSuperFinalizeCheck
 

Related Vulnerabilities

AXIS2-4163 describes a vulnerability in the finalize() method in the Axis web services framework. The finalizer incorrectly calls super.finalize() before doing its own cleanup, leading to errors in GlassFish when the garbage collector runs.

Related Guidelines

MITRE CWE

CWE-586, Explicit call to Finalize()

CWE-583, finalize() Method Declared Public

CWE-568, finalize() Method without super.finalize()

Bibliography

[API 2014]

Class System
finalize()

[Bloch 2008]

Item 7, "Avoid Finalizers"

[Boehm 2005]

 


[Coomes 2007]

"'Sneaky' Memory Retention"

[Darwin 2004]

Section 9.5, "The Finalize Method"

[Flanagan 2005]

Section 3.3, "Destroying and Finalizing Objects"

[JLS 2015]

§12.6, "Finalization of Class Instances"

...


...