Security - Array is stored directly

Question

I even refered : Sonar Violation: Security - Array is stored directly

My code is as --->

    public final void setSelectedObjectsList(final ScheduleDTO[] selectedObjectsList) 
               //      Security - Array is stored directly    
               //The user-supplied array 'selectedObjectsList' is stored directly.      
{
            if (selectedObjectsList != null) {
                this.selectedObjectsList = selectedObjectsList.clone();
            } else {
                this.selectedObjectsList = null;
            }
        }

This is already taking care of defensive copy wonder why sonar is yelling at me right at function parameter.

This not not duplicate as Sonar Violation: Security - Array is stored directly

Again, Thank-you for your hyelp and time.

Answer 1

Not sure what Sonar is thinking but defensive shallow copying with clone() should work fine for arrays, as would Arrays.copyOf and System.arrayCopy().

On the other hand, since you are already calling the array a list: selectedObjectsList, you could also make it an actual list and refactor a bit:

public final void setSelectedSchedules(List<ScheduleDTO> selectedSchedules) {
    this.selectedSchedules = selectedSchedules != null ? new ArrayList<ScheduleDTO>(selectedSchedules) : null;
}