Package edu.umd.cs.findbugs.detect

Class UnsafeDetector

  • All Implemented Interfaces:
    Detector, Priorities, org.apache.bcel.classfile.Visitor
    public class UnsafeDetector
extends OpcodeStackDetector
    Detector for identifying usage of sun.misc.Unsafe or jdk.internal.misc.Unsafe methods in Java bytecode. This class extends OpcodeStackDetector and reports a bug whenever an INVOKEVIRTUAL instruction targets one of the Unsafe classes.

    Unsafe operations can compromise memory safety and are discouraged in most Java applications. This detector helps flag such usages for further review.

    Detected issues are reported to the provided BugReporter with high priority.

    • Field Detail

      • bugReporter

        private final BugReporter bugReporter
        The BugReporter instance used to report detected bugs. This field is initialized via constructor injection and is used throughout the detector to log or report any unsafe code patterns found during analysis.

    • Constructor Detail

      • UnsafeDetector

        public UnsafeDetector​(BugReporter reporter)
        Constructs a new UnsafeDetector with the specified BugReporter.
        Parameters:
        reporter - the BugReporter instance used to report detected bugs

    • Method Detail

      • sawOpcode

        public void sawOpcode​(int seen)
        Inspects bytecode instructions as they are encountered. Specifically, this method checks if the current opcode is an invocation of a virtual method (INVOKEVIRTUAL) on the sun/misc/Unsafe or jdk/internal/misc/Unsafe classes. If such a call is detected, it reports a high-priority bug instance indicating the use of potentially unsafe operations.
        Specified by:
        sawOpcode in class OpcodeStackDetector
        Parameters:
        seen - the opcode of the currently visited instruction
        See Also:
        OpcodeStackDetector.beforeOpcode(int)