rspec/rules/S2225/java/rule.adoc
Egon Okerman d1417e82f8
Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) (#3529)
* Fix all CWE references

* Fix all OWASP references

* Fix missing CWE prefixes
2024-01-15 17:15:56 +01:00

48 lines
1010 B
Plaintext

== Why is this an issue?
Calling ``++toString()++`` or ``++clone()++`` on an object should always return a string or an object. Returning ``++null++`` instead contravenes the method's implicit contract.
=== Noncompliant code example
[source,java]
----
public String toString () {
if (this.collection.isEmpty()) {
return null; // Noncompliant
} else {
// ...
----
=== Compliant solution
[source,java]
----
public String toString () {
if (this.collection.isEmpty()) {
return "";
} else {
// ...
----
== Resources
* CWE - https://cwe.mitre.org/data/definitions/476[CWE-476 - NULL Pointer Dereference]
* https://wiki.sei.cmu.edu/confluence/x/aDdGBQ[CERT, EXP01-J.] - Do not use a null in a case where an object is required
ifdef::env-github,rspecator-view[]
'''
== Implementation Specification
(visible only on this page)
include::../message.adoc[]
'''
== Comments And Links
(visible only on this page)
include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]