Class UnsafeDetector

java.lang.Object

edu.umd.cs.findbugs.visitclass.BetterVisitor

edu.umd.cs.findbugs.visitclass.PreorderVisitor

edu.umd.cs.findbugs.visitclass.AnnotationVisitor

edu.umd.cs.findbugs.visitclass.DismantleBytecode

edu.umd.cs.findbugs.BytecodeScanningDetector

edu.umd.cs.findbugs.bcel.OpcodeStackDetector

edu.umd.cs.findbugs.detect.UnsafeDetector

All Implemented Interfaces:

Detector, Priorities, org.apache.bcel.classfile.Visitor

public class UnsafeDetector
extends OpcodeStackDetector

Detector for identifying usage of sun.misc.Unsafe or jdk.internal.misc.Unsafe methods in Java bytecode. This class extends OpcodeStackDetector and reports a bug whenever an INVOKEVIRTUAL instruction targets one of the Unsafe classes.

Unsafe operations can compromise memory safety and are discouraged in most Java applications. This detector helps flag such usages for further review.

Detected issues are reported to the provided BugReporter with high priority.

Nested Class Summary

Nested classes/interfaces inherited from class OpcodeStackDetector

OpcodeStackDetector.WithCustomJumpInfo

Field Summary

Fields

Modifier and Type	Field	Description
private final BugReporter	bugReporter	The BugReporter instance used to report detected bugs.

Fields inherited from class OpcodeStackDetector

stack

Fields inherited from class DismantleBytecode

codeBytes, lineNumberTable, M_BR, M_CP, M_INT, M_PAD, M_R, M_UINT

Fields inherited from interface Priorities

EXP_PRIORITY, HIGH_PRIORITY, IGNORE_PRIORITY, LOW_PRIORITY, NORMAL_PRIORITY

Constructor Summary

Constructors

Constructor	Description
UnsafeDetector(BugReporter reporter)	Constructs a new UnsafeDetector with the specified BugReporter.

Method Summary

Modifier and Type	Method	Description
void	sawOpcode(int seen)	Inspects bytecode instructions as they are encountered.

Methods inherited from class OpcodeStackDetector

afterOpcode, beforeOpcode, getStack, isUsingCustomUserValue, visitCode

Methods inherited from class BytecodeScanningDetector

getClassContext, report, shouldVisitCode, visitClassContext

Methods inherited from class DismantleBytecode

areOppositeBranches, atCatchBlock, getBranchFallThrough, getBranchOffset, getBranchTarget, getClassConstantOperand, getClassDescriptorOperand, getCodeByte, getConstantRefOperand, getDefaultSwitchOffset, getDottedClassConstantOperand, getFieldDescriptorOperand, getIntConstant, getLongConstant, getMaxPC, getMethodDescriptorOperand, getNameConstantOperand, getNextCodeByte, getNextOpcode, getNextPC, getOpcode, getPC, getPrevOpcode, getRefFieldIsStatic, getRegisterOperand, getSigConstantOperand, getStringConstantOperand, getSwitchLabels, getSwitchOffsets, getXClassOperand, getXFieldOperand, getXMethodOperand, isBranch, isIf, isMethodCall, isRegisterLoad, isRegisterStore, isRegisterStore, isReturn, isShift, isSwitch, isWideOpcode, normalizeNullComparison, printOpCode, sawBranchTo, sawClass, sawDouble, sawField, sawFloat, sawIMethod, sawInt, sawLong, sawMethod, sawRegister, sawString, visit

Methods inherited from class AnnotationVisitor

getAnnotationParameterAsEnum, getAnnotationParameterAsString, getAnnotationParameterAsStringArray, visitAnnotation, visitAnnotation, visitParameterAnnotation, visitParameterAnnotation, visitSyntheticParameterAnnotation

Methods inherited from class PreorderVisitor

amVisitingMainMethod, asUnsignedByte, doVisitMethod, getClassDescriptor, getClassName, getCode, getConstantPool, getDottedClassName, getDottedMethodSig, getDottedSuperclassName, getField, getFieldDescriptor, getFieldIsStatic, getFieldName, getFieldSig, getFullyQualifiedFieldName, getFullyQualifiedMethodName, getMethod, getMethodDescriptor, getMethodName, getMethodSig, getMethodVisitOrder, getNumberArguments, getNumberMethodArguments, getPackageName, getSizeOfSurroundingTryBlock, getSizeOfSurroundingTryBlock, getSourceFile, getStringFromIndex, getSuperclassName, getSurroundingCaughtExceptions, getSurroundingCaughtExceptions, getSurroundingCaughtExceptionTypes, getSurroundingTryBlock, getSurroundingTryBlock, getThisClass, getXClass, getXField, getXMethod, hasInterestingClass, hasInterestingMethod, isVisitMethodsInCallOrder, setupVisitorForClass, setVisitMethodsInCallOrder, shouldVisit, toString, visitAfter, visitAfter, visitAnnotationDefault, visitAnnotationEntry, visitBootstrapMethods, visitConstantInvokeDynamic, visitConstantMethodHandle, visitConstantMethodType, visitConstantModule, visitConstantPackage, visitConstantPool, visitEnclosingMethod, visitingField, visitingMethod, visitInnerClasses, visitJavaClass, visitLineNumberTable, visitLocalVariableTable, visitMethodParameters, visitParameterAnnotationEntry, visitStackMap, visitStackMapEntry

Methods inherited from class BetterVisitor

clone, report, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visitCodeException, visitConstantClass, visitConstantDouble, visitConstantFieldref, visitConstantFloat, visitConstantInteger, visitConstantInterfaceMethodref, visitConstantLong, visitConstantMethodref, visitConstantNameAndType, visitConstantString, visitConstantUtf8, visitConstantValue, visitDeprecated, visitExceptionTable, visitField, visitInnerClass, visitLineNumber, visitLocalVariable, visitLocalVariableTypeTable, visitMethod, visitSignature, visitSourceFile, visitSynthetic, visitUnknown

Methods inherited from class Object

equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface org.apache.bcel.classfile.Visitor

visitConstantDynamic, visitMethodParameter, visitModule, visitModuleExports, visitModuleMainClass, visitModuleOpens, visitModulePackages, visitModuleProvides, visitModuleRequires, visitNestHost, visitNestMembers, visitRecord, visitRecordComponent, visitStackMapType

Field Details

bugReporter

private final BugReporter bugReporter

The BugReporter instance used to report detected bugs. This field is initialized via constructor injection and is used throughout the detector to log or report any unsafe code patterns found during analysis.

Constructor Details

UnsafeDetector

public UnsafeDetector(BugReporter reporter)

Constructs a new UnsafeDetector with the specified BugReporter.

Parameters:

reporter - the BugReporter instance used to report detected bugs

Method Details

sawOpcode

public void sawOpcode(int seen)

Inspects bytecode instructions as they are encountered. Specifically, this method checks if the current opcode is an invocation of a virtual method (INVOKEVIRTUAL) on the sun/misc/Unsafe or jdk/internal/misc/Unsafe classes. If such a call is detected, it reports a high-priority bug instance indicating the use of potentially unsafe operations.

Specified by:

sawOpcode in class OpcodeStackDetector

Parameters:

seen - the opcode of the currently visited instruction

See Also:

• OpcodeStackDetector.beforeOpcode(int)