Page Information

Title:	OBJ11-J. Be wary of letting constructors throw exceptions
Author:	Dhruv Mohindra	Jul 28, 2008
Last Changed by:	David Svoboda	Aug 06, 2025
Tiny Link: (useful for email)	https://wiki.sei.cmu.edu/confluence/x/bTdGBQ
Export As:	Word · PDF

SEI CERT Oracle Coding Standard for Java (10)     Page: SEC03-J. Do not load trusted classes after allowing untrusted code to load arbitrary classes     Page: TSM01-J. Do not let the this reference escape during object construction     Page: MET12-J. Do not use finalizers     Page: TSM03-J. Do not publish partially initialized objects     Page: SER03-J. Do not serialize unencrypted sensitive data     Page: OBJ07-J. Sensitive classes must not let themselves be copied     Page: OBJ58-J. Limit the extensibility of classes and methods with invariants     Page: SER07-J. Do not use the default serialized form for classes with implementation-defined invariants     Page: OBJ10-J. Do not use public static nonfinal fields     Page: OBJ13-J. Ensure that references to mutable objects are not exposed

Parent Page     Page: Rule 05. Object Orientation (OBJ)

• draft
• android-applicable
• exportable-c++
• rule
• analyzable
• obj
• cwe-362
• deprecated-applet

Time	Editor
Aug 06, 2025 10:38	Jill Britton	View Changes
REM cost reform
Jul 24, 2025 08:53	Jill Britton	View Changes
May 18, 2021 08:45	Michal Rozenau	View Changes
Migration of unmigrated content due to installation of a new plugin
May 18, 2021 08:45	Michal Rozenau	View Changes
Migration of unmigrated content due to installation of a new plugin
May 18, 2021 08:45	Michal Rozenau
Migration of unmigrated content due to installation of a new plugin

External Links (11)
    www.oracle.com/technetwork/java/seccodeguide-139067.html
    docs.oracle.com/javase/specs/jls/se8/html/jls-8.html#jls-8.…
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-535…
    docs.oracle.com/javase/specs/jls/se8/html/jls-17.html#jls-1…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    https://www.securecoding.cert.org/confluence/display/java/A…
    Rule BB. Glossary#vulnerability
    docs.oracle.com/javase/specs/jls/se8/html/jls-12.html#jls-1…
    java.sun.com/j2se/1.4.2/docs/api/java/lang/Object.html#fina…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…

SEI CERT Oracle Coding Standard for Java (14)     Page: Klocwork_V     Page: Parasoft_V     Page: TSM01-J. Do not let the this reference escape during object construction     Home page: SEI CERT Oracle Coding Standard for Java     Page: Rule AA. References     Page: Rule BB. Glossary     Page: TSM03-J. Do not publish partially initialized objects     Page: OBJ02-J. Preserve dependencies in subclasses when changing superclasses     Page: ERR00-J. Do not suppress or ignore checked exceptions     Page: Klocwork     Page: MET12-J. Do not use finalizers     Page: ERR03-J. Restore prior object state on method failure     Page: SER08-J. Minimize privileges before deserializing from a privileged context     Page: Parasoft