rspec/rules/S2151/java/rule.adoc

== Why is this an issue?

include::../description.adoc[]

=== Noncompliant code example

[source,java,diff-id=1,diff-type=noncompliant]
----
public static void main(String [] args) {
  System.runFinalizersOnExit(true);  // Noncompliant
}

protected void finalize(){
  doShutdownOperations();
}
----


=== Compliant solution

[source,java,diff-id=1,diff-type=compliant]
----
public static void main(String [] args) {
  Thread myThread = new Thread( () -> { doShutdownOperations(); });
  Runtime.getRuntime().addShutdownHook(myThread);
}
----


== Resources

* https://wiki.sei.cmu.edu/confluence/x/4jZGBQ[CERT, MET12-J.] - Do not use finalizers


ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

Remove this call to "XXX.runFinalizersOnExit()".


'''
== Comments And Links
(visible only on this page)

=== on 25 Nov 2014, 16:45:38 Freddy Mallet wrote:
@Ann, according to my compliant solution I would increase the remediation cost to 20 minutes. 

=== on 16 Jan 2015, 09:40:23 Sébastien Gioria wrote:
Could be tag security and cwe : 

CERT Secure Coding reference : \https://www.securecoding.cert.org/confluence/display/java/MET12-J.+Do+not+use+finalizers

CWE : \http://cwe.mitre.org/data/definitions/586.html

=== on 19 Jan 2015, 08:39:06 Ann Campbell wrote:
\[~sebastien.gioria], I've added the CERT reference, but not the one for CWE, which seems to have a pretty narrow scope.

endif::env-github,rspecator-view[]