将“使私有或可序列化”错误标记为误报

Question

In one of my Serializable class, Sonar is complaining, "Make empName transient or Serializable" for below property. I changed Object to Serializable ( protected Map<String, Serializable> empName; ). Now its giving "Make empName private or Serializable" error. My question is, can I mark it as false positive because if the type of the value is Serializable then Java will give error either at compile time or runtime ?

Property Declaration:

protected Map<String, Object> empName;

Thanks

Answer 1

No. It is not a false positive, in general. The interface Map does not implement Serializable . Therefore empName could refer to a non-serializable map, which would lead to a runtime exception.

In some contexts, this could be a false positive. For example, if can proved that empName is never assigned a non-serializable map, then this is a false positive.

However, since you have declared the field as protected and not final , you would need to analyze the class containing this declaration and all possible subclasses , and check all assignments to the field. (Indeed, if you want to be really thorough you also need for reflective assignments.)