java - 缺少对 Null 的检查

Question

对于下面提到的代码，我面临以下安全警告:

 if (null != FacesContext.getCurrentInstance()) {

            FacesContext context = FacesContext.getCurrentInstance();

            if ((null != context.getApplication())
                    && (null != context.getApplication().getVariableResolver())) {

                if (null != context.getApplication().getVariableResolver()
                        .resolveVariable(context, "userBean")) {

                    Object requestObject = context.getApplication()
                            .getVariableResolver().resolveVariable(context,
                                    "userBean");

                    String pRange = ((UserBean) requestObject)
                            .getPageSize_REM();

                    page_range = Integer.parseInt(pRange);

                }

            }
        }

我在强化报告中收到的警告是:

Abstract: The method getList() in GrantAccessBackingBean.java can dereference a null pointer on line 2357 because it does not check the return value of resolveVariable(), which might return null. Sink: GrantAccessBackingBean.java:2353 requestObject = resolveVariable(...) : VariableResolver.resolveVariable may return NULL() 2351 .resolveVariable(context, "userBean")) { 2352 Object requestObject = context.getApplication() 2353 .getVariableResolver().resolveVariable(context, 2354 "userBean");

虽然我正在检查所有空引用条件，但它仍然给了我。有什么建议吗？提前致谢

Answer 1

我的猜测是报告无法确定这一点

if (null != context.getApplication().getVariableResolver()
                        .resolveVariable(context, "userBean")) 

和

Object requestObject = context.getApplication()
                              .getVariableResolver()
                              .resolveVariable(context, "userBean");

评估结果相同。为什么不将代码更改为

Object requestObject = context.getApplication()
                              .getVariableResolver()
                              .resolveVariable(context, "userBean");
if (requestObject != null)
{
}

看看这是否有帮助。

(如果没有，它至少会消除现在每个空检查都存在的重复调用)