Secure Coding mailing list archives

Compilers


From: leichter_jerrold at emc.com (Leichter, Jerry)
Date: Thu, 4 Jan 2007 17:28:03 -0500 (EST)

| Florian Weimer wrote:
| > * Crispin Cowan:
| >   
| >> ljknews wrote:
| >>     
| >>>   2. The compiler market is so immature that some people are still
| >>>      using C, C++ and Java.
| >>>       
| >> I'm with you on the C and C++ argument, but what is immature about Java?
| >> I thought Java was a huge step forward, because for the first time, a
| >> statically typesafe language was widely popular.
| >>     
| > Java is not statically typesafe, see the beloved ArrayStoreException
| > (and other cases, depending what you mean by "statically typesafe").
| >   
| So every language that supports arrays is not statically type safe? How
| else can a language guarantee array bounds checking without having to
| resort to array bounds checking in cases where the indicies are
| dynamically computed?...
That was a bad example.

Java isn't statically typesafe because one can write programs that cast
objects.  The casts are checked - at runtime.  The most obvious place
this shows up is in containers.  Until Java 1.5, containers held
instances of Object.  If you were handed a Set of Circle's, when you
pulled out one instances from the Set, you got an Object.  It was up to
you to cast it to a Circle.  If some inserted a Cube into the class,
your cast would fail with an exception.  (You could also explicitly test
if you wanted.)

Parameterized types in Java 1.5 help to some degree, in that the
compiler effectively checks that only Circle's are ever inserted into
your Set<Circle>, but the model used is very limited, the old constructs
remain - in fact, a constraint was that new and old code interoperate, so
if some code got at your set as just a Set, they could put any Object into
it - and there are still plenty of places where you can lose static
type safety.

It's *possible* to write Java code that uses types conservatively and
never does a cast that could fail at run time.  Then again, you *can*
write C code like that.  But the compiler won't help you.  And there
are all kinds of common Java coding patterns that rely on the dynamic
type system, and can't be written in a purely static type style.

                                                        -- Jerry



Current thread: