[GitHub] [pulsar] lhotari commented on pull request #19315: [improve][build] Upgrade Spotbugs to a version with JDK 17 compatibility

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari commented on PR #19315:
URL: https://github.com/apache/pulsar/pull/19315#issuecomment-1491387923

   Adding a comment here so that we have some documentation about handling EI_EXPOSE_REP Spotbugs errors.
   
   This is the [spotbugs description for EI_EXPOSE_REP](https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#ei-may-expose-internal-representation-by-returning-reference-to-mutable-object-ei-expose-rep)
   > EI: May expose internal representation by returning reference to mutable object (EI_EXPOSE_REP)
   Returning a reference to a mutable object value stored in one of the object's fields exposes the internal representation of the object. If instances are accessed by untrusted code, and unchecked changes to the mutable object would compromise security or other important properties, you will need to do something different. Returning a new copy of the object is better approach in many situations.
   
   Newer versions of Spotbugs enable this rule by default. One possibility is to ignore the error.
   
   There are 2 ways to ignore the error: with an annotation or with an XML file. Since there was a lot of locations where this is happening, I used the XML file in this PR. Having the rule is useful since we should be thinking of the implications of thread safety and so on when a mutable object is shared.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org