8005065: [findbugs] reference to mutable array in JavaBeans

Reviewed-by: alexsch

jdk/src/share/classes/java/beans/DefaultPersistenceDelegate.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -58,7 +58,8 @@ import sun.reflect.misc.*;
  */
 
 public class DefaultPersistenceDelegate extends PersistenceDelegate {
-    private String[] constructor;
+    private static final String[] EMPTY = {};
+    private final String[] constructor;
     private Boolean definesEquals;
 
     /**
@@ -67,7 +68,7 @@ public class DefaultPersistenceDelegate extends PersistenceDelegate {
      * @see #DefaultPersistenceDelegate(java.lang.String[])
      */
     public DefaultPersistenceDelegate() {
-        this(new String[0]);
+        this.constructor = EMPTY;
     }
 
     /**
@@ -92,7 +93,7 @@ public class DefaultPersistenceDelegate extends PersistenceDelegate {
      * @see #instantiate
      */
     public DefaultPersistenceDelegate(String[] constructorPropertyNames) {
-        this.constructor = constructorPropertyNames;
+        this.constructor = (constructorPropertyNames == null) ? EMPTY : constructorPropertyNames.clone();
     }
 
     private static boolean definesEquals(Class<?> type) {

jdk/src/share/classes/java/beans/EventSetDescriptor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -277,7 +277,9 @@ public class EventSetDescriptor extends FeatureDescriptor {
                 Method removeListenerMethod)
                 throws IntrospectionException {
         setName(eventSetName);
-        this.listenerMethodDescriptors = listenerMethodDescriptors;
+        this.listenerMethodDescriptors = (listenerMethodDescriptors != null)
+                ? listenerMethodDescriptors.clone()
+                : null;
         setAddListenerMethod(addListenerMethod);
         setRemoveListenerMethod(removeListenerMethod);
         setListenerType(listenerType);
@@ -347,7 +349,9 @@ public class EventSetDescriptor extends FeatureDescriptor {
      * events are fired.
      */
     public synchronized MethodDescriptor[] getListenerMethodDescriptors() {
-        return listenerMethodDescriptors;
+        return (this.listenerMethodDescriptors != null)
+                ? this.listenerMethodDescriptors.clone()
+                : null;
     }
 
     /**

jdk/src/share/classes/java/beans/MethodDescriptor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -70,7 +70,9 @@ public class MethodDescriptor extends FeatureDescriptor {
                 ParameterDescriptor parameterDescriptors[]) {
         setName(method.getName());
         setMethod(method);
-        this.parameterDescriptors = parameterDescriptors;
+        this.parameterDescriptors = (parameterDescriptors != null)
+                ? parameterDescriptors.clone()
+                : null;
     }
 
     /**
@@ -161,7 +163,9 @@ public class MethodDescriptor extends FeatureDescriptor {
      *          a null array if the parameter names aren't known.
      */
     public ParameterDescriptor[] getParameterDescriptors() {
-        return parameterDescriptors;
+        return (this.parameterDescriptors != null)
+                ? this.parameterDescriptors.clone()
+                : null;
     }
 
     /*

jdk/src/share/classes/java/beans/Statement.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -92,7 +92,7 @@ public class Statement {
     public Statement(Object target, String methodName, Object[] arguments) {
         this.target = target;
         this.methodName = methodName;
-        this.arguments = (arguments == null) ? emptyArray : arguments;
+        this.arguments = (arguments == null) ? emptyArray : arguments.clone();
     }
 
     /**
@@ -128,7 +128,7 @@ public class Statement {
      * @return the array of arguments
      */
     public Object[] getArguments() {
-        return arguments;
+        return this.arguments.clone();
     }
 
     /**

jdk/test/java/beans/Introspector/Test8005065.java

@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8005065
+ * @summary Tests that all arrays in JavaBeans are guarded
+ * @author Sergey Malenkov
+ */
+
+import java.beans.DefaultPersistenceDelegate;
+import java.beans.Encoder;
+import java.beans.EventSetDescriptor;
+import java.beans.ExceptionListener;
+import java.beans.Expression;
+import java.beans.Statement;
+import java.beans.MethodDescriptor;
+import java.beans.ParameterDescriptor;
+
+public class Test8005065 {
+
+    public static void main(String[] args) {
+        testDefaultPersistenceDelegate();
+        testEventSetDescriptor();
+        testMethodDescriptor();
+        testStatement();
+    }
+
+    private static void testDefaultPersistenceDelegate() {
+        Encoder encoder = new Encoder();
+        String[] array = { "array" };
+        MyDPD dpd = new MyDPD(array);
+        dpd.instantiate(dpd, encoder);
+        array[0] = null;
+        dpd.instantiate(dpd, encoder);
+    }
+
+    private static void testEventSetDescriptor() {
+        try {
+            MethodDescriptor[] array = { new MethodDescriptor(MyDPD.class.getMethod("getArray")) };
+            EventSetDescriptor descriptor = new EventSetDescriptor(null, null, array, null, null);
+            test(descriptor.getListenerMethodDescriptors());
+            array[0] = null;
+            test(descriptor.getListenerMethodDescriptors());
+            descriptor.getListenerMethodDescriptors()[0] = null;
+            test(descriptor.getListenerMethodDescriptors());
+        }
+        catch (Exception exception) {
+            throw new Error("unexpected error", exception);
+        }
+    }
+
+    private static void testMethodDescriptor() {
+        try {
+            ParameterDescriptor[] array = { new ParameterDescriptor() };
+            MethodDescriptor descriptor = new MethodDescriptor(MyDPD.class.getMethod("getArray"), array);
+            test(descriptor.getParameterDescriptors());
+            array[0] = null;
+            test(descriptor.getParameterDescriptors());
+            descriptor.getParameterDescriptors()[0] = null;
+            test(descriptor.getParameterDescriptors());
+        }
+        catch (Exception exception) {
+            throw new Error("unexpected error", exception);
+        }
+    }
+
+    private static void testStatement() {
+        Object[] array = { new Object() };
+        Statement statement = new Statement(null, null, array);
+        test(statement.getArguments());
+        array[0] = null;
+        test(statement.getArguments());
+        statement.getArguments()[0] = null;
+        test(statement.getArguments());
+    }
+
+    private static <T> void test(T[] array) {
+        if (array.length != 1) {
+            throw new Error("unexpected array length");
+        }
+        if (array[0] == null) {
+            throw new Error("unexpected array content");
+        }
+    }
+
+    public static class MyDPD
+            extends DefaultPersistenceDelegate
+            implements ExceptionListener {
+
+        private final String[] array;
+
+        public MyDPD(String[] array) {
+            super(array);
+            this.array = array;
+        }
+
+        public Expression instantiate(Object instance, Encoder encoder) {
+            encoder.setExceptionListener(this);
+            return super.instantiate(instance, encoder);
+        }
+
+        public String[] getArray() {
+            return this.array;
+        }
+
+        public void exceptionThrown(Exception exception) {
+            throw new Error("unexpected error", exception);
+        }
+    }
+}