SonarQube扫描常见Bug、漏洞修复整理（持续更新中）

系统管理员 2024-03-30 10:57 73阅读 0赞

#### 目录 ####

*  DMS
 *   *  1、A "NullPointerException" could be thrown; "sra" is nullable here.
     *  2、Cast one of the operands of this multiplication operation to a "long"
     *  3、Call "remove()" on "requestContainer".
     *  4、Use try-with-resources or close this "FileInputStream" in a "finally" clause.
     *  5、Change this condition so that it does not always evaluate to "false"
     *  6、Use the "equals" method if value comparison was intended.
     *  7、Do something with the "boolean" value returned by "delete".
     *  8、Either re-interrupt this method or rethrow the "InterruptedException" that can be caught here.
 *  DQC
 *   *  1、Use "BigDecimal.valueOf" instead.
     *  2、Remove this "break" statement or make it conditional.
     *  3、Remove this conditional structure or edit its code blocks so that they're not all the same.

## DMS ##

### 1、A “NullPointerException” could be thrown; “sra” is nullable here. ###

![在这里插入图片描述][248815b474f24940b900cb47ff7d804d.png]

> 这种提示是指可能存在[空指针异常][Link 1]，需要增加空值检测。  
> 说明：未做非空校验，可能产生空指针  
> 解决方案：加上非空校验  
> 解决方式：先判断或者先实例化，再访问里面的属性或者成员。

### 2、Cast one of the operands of this multiplication operation to a “long” ###

![在这里插入图片描述][06823e05be574dc9805ed37b6cdf50ef.png]

> 说明：int数运算最终再把结果转为long将有可能产生溢出

解决方案：转换为long型预算 
     举例： 
     long bigNum = Integer.MAX_VALUE + 2; // Noncompliant. Yields -2147483647 
     换为 
     long bigNum = Integer.MAX_VALUE + 2L;

### 3、Call “remove()” on “requestContainer”. ###

![在这里插入图片描述][1c89fcec97904398a45ef6bf66e1c687.png]

> 说明：防止内存泄露溢出，ThreadLocal字段【requestContainer】应该至少调用一次remove()方法。

// 解决方案：定义删除方法
     public void removeRequest() {
        
          requestContainer.remove();
     }

### 4、Use try-with-resources or close this “FileInputStream” in a “finally” clause. ###

![在这里插入图片描述][9547171d0f2b4717bf0c7a13a3ee4c96.png]

> 说明：使用try-with-resources或在 “finally” 子句中关闭此 “BufferedOutputStream”。

// 解决方案1：使用try-with-resources
     BufferedOutputStream out = null;
     try(BufferedOutputStream out = new BufferedOutputStream(new FileOutputStream(new File("C://test"))) {
        
         out.write(file.getBytes());
         out.flush();
         return Result.success("上传成功！", null);
     } catch (IOException e) {
        
        return Result.error("上传失败！");
     }

// 解决方案2：“finally” 子句中关闭流
     BufferedOutputStream out = null;
     try {
        
         out = new BufferedOutputStream(new FileOutputStream(new File("C://test"));
         out.write(file.getBytes());
         out.flush();
         return Result.success("上传成功！", null);
     } catch (IOException e) {
        
        return Result.error("上传失败！");
     } finally {
        
         CloseIoUtils.closeAll(out);
     }

### 5、Change this condition so that it does not always evaluate to “false” ###

![在这里插入图片描述][d7213b6fa6204d0096bdfa0908d13296.png]

> 说明：checkInsertParam方法没有返回false的情况一直是true，所以条件判断后一直返回的结果为false。需要改条件判断或者添加方案中异常false情况返回。

### 6、Use the “equals” method if value comparison was intended. ###

![在这里插入图片描述][8737f5daf73346ae9db435064b196b55.png]

> 说明：使用引用等式==或！=，比较java.lang.String或装箱类型（如java.lang.Integer）的两个实例几乎总是一个错误，因为它不是比较实际值，而是比较内存中的位置

解决：将 “==” 换成 equals 比较

### 7、Do something with the “boolean” value returned by “delete”. ###

![在这里插入图片描述][863f41a68b114cb1a61b3a8e6f0ba66a.png]

//解决方案:增加false判断
    if (!csvFile.delete()) {
        
          log.error("文件删除失败");
    }

### 8、Either re-interrupt this method or rethrow the “InterruptedException” that can be caught here. ###

![在这里插入图片描述][63e3d7807fcd43618809b690fe8d47c7.png]

//解决方案 
     try(){
        
    	 //业务代码...
     }catch (InterruptedException e){
        
     	 //抛出InterruptedException   异常需要重新清除线程的中断状态,添加如下
     	 Thread.currentThread().interrupt();
     }

## DQC ##

### 1、Use “BigDecimal.valueOf” instead. ###

![在这里插入图片描述][cc38fc4df9d7451486e145c0e377d018.png]

> 说明：由于浮点不精确，您不太可能从BigDecimal(double)构造函数中获得预期的值。

//解决方案
     BigDecimal.valueOf((double) (Float) r)

### 2、Remove this “break” statement or make it conditional. ###

![在这里插入图片描述][51dfd9f95e774d88ae1d0c3af29c03a1.png]

> 说明：移除break；或者把它放在条件中

### 3、Remove this conditional structure or edit its code blocks so that they’re not all the same. ###

![在这里插入图片描述][5153d718f3ef43778c6bf420bfbca4fe.png]

> 说明：写if else的时候，卡条件卡得离散了一点，本身可以合成一个的，结果写成了多级if，增加了程序的复杂度。  
> 解决：去掉if else语句

[248815b474f24940b900cb47ff7d804d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/ac86027bf1d14470a61a2f219d65c4bb.png
[Link 1]: https://so.csdn.net/so/search?q=%E7%A9%BA%E6%8C%87%E9%92%88%E5%BC%82%E5%B8%B8&spm=1001.2101.3001.7020
[06823e05be574dc9805ed37b6cdf50ef.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/9fc73aa1421348bbb97ac017a6631d70.png
[1c89fcec97904398a45ef6bf66e1c687.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/f8a3ddd3e2a0479bb21a1990c1009fa1.png
[9547171d0f2b4717bf0c7a13a3ee4c96.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/9f948f4129ed46c49c71b2dc7327dee6.png
[d7213b6fa6204d0096bdfa0908d13296.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/358b037111c447e1897ba2bcc72c71fd.png
[8737f5daf73346ae9db435064b196b55.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/d26aab24b4304a1eaa750d4500f44247.png
[863f41a68b114cb1a61b3a8e6f0ba66a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/626fdc05b9de422c95113d208340e9e0.png
[63e3d7807fcd43618809b690fe8d47c7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/2be28c700a8f42bf93674c12d01058f2.png
[cc38fc4df9d7451486e145c0e377d018.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/bc5ce0a8dbf04409abf86c042eec326e.png
[51dfd9f95e774d88ae1d0c3af29c03a1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/57b7c82a609b4eae872db2bd36bb68d6.png
[5153d718f3ef43778c6bf420bfbca4fe.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/f41023973e124dd1b63cb53000c1ba0a.png