JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
Java


JAVA.CLASS.ICSBS : Inner Class Should be Static (Java)

Summary

An inner class should be made static.

Inner classes can be defined in Java as static or non-static. The former cannot directly access instance fields of the outer class, while the latter have the ability to refer to the instance of the outer class passed at time of their creation and consequently also to its instance fields. However, this comes at the price of embedding an implicit reference, in each instance of the inner class, to the wrapping instance of the outer class, which makes objects larger and prevents garbage collection of the outer instance. This can result in memory exhaustion. Moreover, non-static inner classes expose the risk of ambiguity for method calls that could refer to both local methods and methods of the outer class.

Properties

Class Name Inner Class Should be Static (Java)
Significance reliability
Mnemonic JAVA.CLASS.ICSBS
Categories
CWE CWE:492 Use of Inner Class Containing Sensitive Data
CERT-Java CERT-Java:OBJ08-J Do not expose private members of an outer class from within a nested class
Availability Available for Java and Kotlin.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Inner Class Should be Static (Java)"

Example

public class InnerClasses {
  public void foo() {}
  public void test() {}

  public class C1 { /* Inner Class Should be Static (Java) warning issued here
                     * warning issued here: C1 does not access the outer class instance.
                     */    
    public void foo() {}
    public void test() {
        foo();      /* Ambiguous Call from Inner Class (Java) 
                     * warning issued here: it is not always obvious to human readers  whether this is a 
                     * call to C1.foo() or to InnerClasses.foo(), and this can lead to code correctness problems.
                     */    
    }
  }

  public static class C2 {              // ok: already static              
    public void foo() {}
    public void test() {
        foo();                          // ok: can only be referring to C2.foo() because there is no access to the outer instance    
    }
  }

  public final InnerClasses o1 = new InnerClasses() {
    @Override
    public void test() {
        foo();
    }
  };

  public final InnerClasses o2 = new InnerClasses() {
    @Override
    public void test() {
      foo();                            // ok: o2 definition of foo() overrides parent definition     
    }

    @Override
    public void foo() {}
  };

  public final static InnerClasses o3 = new InnerClasses() {
                
    @Override
    public void test() {
      foo();
    }
  };

  public final static InnerClasses o4 = new InnerClasses() {

    @Override
    public void test() {
      foo();
    }

    @Override
    public void foo() {}                // ok: o4 definition of foo() overrides parent definition 
  };
}

In this example, the programmer should for instance rewrite the inner class C1 as follows:

public static class C1 {
  public void moo() {}
  public void test() {
      moo();
  }
}

Resolution

Check if inner classes can be made static, consequently saving memory and reducing the burden on the garbage collector. Avoid using synonyms for methods in the inner class and in the outer class.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

 

To report problems with this documentation, please visit https://support.codesecure.com/.