mxtymoshyk opened a new pull request, #40008:
URL: https://github.com/apache/beam/pull/40008
Part of #35312.
The global SpotBugs filter suppressed `CT_CONSTRUCTOR_THROW` in every
module, so a constructor that throws after publishing `this` was never reported
anywhere. This deletes those three filter lines and fixes everything the
detector then found.
I used two fixes. Where the class is not public, I marked it `final`.
SpotBugs' `ConstructorThrow` detector returns early on a final class, so the
warning goes away because the problem is gone: a finalizer attack needs an
attacker-supplied subclass, and a final class cannot have one. Every other
class gets a `@SuppressFBWarnings` whose justification says why it has to stay
extensible.
A class was made `final` only when it is neither abstract nor public. Code
outside the repo can subclass a package-private class only by declaring itself
inside a Beam package, which is unsupported and breaks under shaded jars, so
sealing it cannot break a downstream user.
Public classes annotated `@Internal` get the suppression as well.
`@Internal` withdraws the compatibility guarantee, but the class is still
reachable, so a forked runner may already extend it and sealing it would break
that fork at compile time. Six classes fall in this category:
`BoundedTrieData`, `ExplicitShardedFile`, `PCollectionViews.SingletonViewFn`,
`PCollectionViews.SingletonViewFn2`, `FnApiDoFnRunner`, and
`SplittableSplitAndSizeRestrictionsDoFnRunner`.
I also checked that nothing in the repo extends any class I sealed. That
check only proves the tree still compiles. It is not by itself a reason to seal
a class, and it says nothing about out-of-tree code.
Verified locally with `./gradlew spotbugsMain spotlessJavaCheck --continue`:
140 modules pass `spotbugsMain`, 190 pass `spotlessJavaCheck`, and no report
contains a `CT_CONSTRUCTOR_THROW` finding.
------------------------
Thank you for your contribution! Follow this checklist to help us
incorporate your contribution quickly and easily:
- [ ] Mention the appropriate issue in your description (for example:
`addresses #123`), if applicable. This will automatically add a link to the
pull request in the issue. If you would like the issue to automatically close
on merging the pull request, comment `fixes #<ISSUE NUMBER>` instead.
- [ ] Update `CHANGES.md` with noteworthy changes.
- [ ] If this contribution is large, please file an Apache [Individual
Contributor License Agreement](https://www.apache.org/licenses/icla.pdf).
See the [Contributor Guide](https://beam.apache.org/contribute) for more
tips on [how to make review process
smoother](https://github.com/apache/beam/blob/master/CONTRIBUTING.md#make-the-reviewers-job-easier).
To check the build health, please visit
[https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md](https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md)
GitHub Actions Tests Status (on master branch)
------------------------------------------------------------------------------------------------
[](https://github.com/apache/beam/actions?query=workflow%3A%22Build+python+source+distribution+and+wheels%22+branch%3Amaster+event%3Aschedule)
[](https://github.com/apache/beam/actions?query=workflow%3A%22Python+Tests%22+branch%3Amaster+event%3Aschedule)
[](https://github.com/apache/beam/actions?query=workflow%3A%22Java+Tests%22+branch%3Amaster+event%3Aschedule)
[](https://github.com/apache/beam/actions?query=workflow%3A%22Go+tests%22+branch%3Amaster+event%3Aschedule)
See [CI.md](https://github.com/apache/beam/blob/master/CI.md) for more
information about GitHub Actions CI or the [workflows
README](https://github.com/apache/beam/blob/master/.github/workflows/README.md)
to see a list of phrases to trigger workflows.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
