It is used to create help for your custom checker. When you deploy your checker, this information will be visible in Klocwork Documentation and in Klocwork Static Code Analysis's context-sensitive help.

At minimum, you must provide a description of the issue.

<?xml version="1.0" encoding="UTF-8"?>
<?xml version="1.0"?>
<help language="java">
    
    <defect id="SV.CLONE.NOFIN">        
        <description>            
            This error appears when clone method is not defined final.            
        </description>
        <risks>            
            This might be a security concern only for library vendors or for mobile code (applets). Clone method is another mechanism that allows to create objects, and it might be unwanted that users can inherit this class and tamper with behavior of this method. 
        </risks>
        <prevention>            
            It is better to use copy constructors than clone methods, if using of clone cannot be avoided make clone methods final.    
        </prevention>        
        <examples>            
            <example line="17">                
                <![CDATA[
                
    protected Object clone()
    
            throws CloneNotSupportedException (
            
        throw new CloneNotSupportedException();
        
    }
    ]]>
                <description>                    
                    SV.CLONE.NOFIN is reported for method declaration on line 17: Method 'clone' defined in class 'com.klocwork.jdefects.checkers.ast.samples.SV_CLONE_NOFIN_Sample_1' is non-final, which may allow an attacker to override its behaviour                     
                </description>                
            </example>            
        </examples>        
    </defect>    
</help>