Java


JAVA.DEBUG.LOG : Debug Warning (Java)

Summary

A method should be replaced with a logging code in production code.

For example, System.out.println() should be not used in production code.

Some operations should not be performed in production code, since they have no effect or have unpredictable effects, or since they might compromise the availability or security of your system.

Properties

Class Name Debug Warning (Java)
Significance reliability
Mnemonic JAVA.DEBUG.LOG
Categories
CWE CWE:209 Generation of Error Message Containing Sensitive Information
  CWE:477 Use of Obsolete Function
  CWE:537 Java Runtime Error Message Containing Sensitive Information
CERT-Java CERT-Java:ERR02-J Prevent exceptions while logging data
Availability Available for Java only.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Debug Warning (Java)"

Example

import com.juliasoft.julia.extraction.EntryPoint;

public class InadequateCalls {
  public @EntryPoint void check(int k) {
      if (k <= 0)
          System.exit(-1);       // Debug Call (Java) warning issued here 
      else
          System.out.println(k); // Debug Warning (Java) warning issued here 
  }
}

In this example, the programmer should signal the unusual situation in other ways, for instance by throwing an exception or by showing a dialog to the user.

Resolution

Verify if the operation is adequate for production code. Remove it or transform it if that is not the case.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.