JD.METHOD.CBSMethod can be staticJD.METHOD.CBS is triggered when a virtual method does not access member variables or call other virtual methods. Vulnerability and riskThe risk is the unjustifiably increased memory footprint of a class. This is particularly sensitive matter for mobile and embedded systems. To avoid this issue, reported methods should become static. Vulnerable code example 11 public class A { 2 public static int val = 0; 3 public int counter = 0; 4 5 public int foo() { // method can be static 6 val = 109; 7 return val; 8 } 9 public int test() { // method can not be static 10 val = 100*counter; 11 return val; 12 } 13 } JD.METHOD.CBS is reported for line 5: Method 'foo' can be declared static. The method 'foo' uses only static class member ‘val’ and doesn’t call any virtual class methods. Since the method is not static, JVM allocates memory for method ‘foo’ each time corresponding object is created. Fixed code example 11 public class A { 2 public static int val = 0; 3 public int counter = 0; 4 5 public static int foo() { // method can be static 6 val = 109; 7 return val; 8 } 9 public int test() { // method can not be static 10 val = 100*counter; 11 return val; 12 } 13 } |