Sonarqube Fixes #1651 #1603

jaxb-ri/codemodel/codemodel-annotation-compiler/src/main/java/com/sun/codemodel/ac/ACTask.java

@@ -32,8 +32,6 @@
 import java.io.IOException;
 import java.lang.annotation.Annotation;
 import java.lang.reflect.Method;
-import java.net.MalformedURLException;
-import java.net.URL;
 import java.util.ArrayList;
 import java.util.Enumeration;
 import java.util.HashMap;

jaxb-ri/codemodel/codemodel/src/main/java/com/sun/codemodel/JAnnotationUse.java

@@ -373,7 +373,7 @@ public JAnnotationArrayMember paramArray(String name){
      * @deprecated
      *      use {@link JAnnotationArrayMember#annotate}
      */
-    @Deprecated
+    @Deprecated(since="4.0.0", forRemoval=true)
     public JAnnotationUse annotate(Class <? extends Annotation> clazz) {
         return new JAnnotationUse(owner().ref(clazz));
     }

jaxb-ri/codemodel/codemodel/src/main/java/com/sun/codemodel/JClassContainer.java

@@ -80,7 +80,7 @@ public interface JClassContainer {
      * @deprecated
      *      use {@link #_class(int, String, ClassType)} 
      */
-    @Deprecated
+    @Deprecated(since="4.0.0", forRemoval=true)
     JDefinedClass _class(int mods, String name, boolean isInterface)
         throws JClassAlreadyExistsException;
 

jaxb-ri/codemodel/codemodel/src/main/java/com/sun/codemodel/JCodeModel.java

@@ -249,7 +249,7 @@ public JDefinedClass _getClass(String fullyQualifiedName) {
      *      The naming convention doesn't match the rest of the CodeModel.
      *      Use {@link #anonymousClass(JClass)} instead.
      */
-    @Deprecated
+    @Deprecated(since="4.0.0", forRemoval=true)
     public JDefinedClass newAnonymousClass(JClass baseType) {
         return new JAnonymousClass(baseType);
     }

jaxb-ri/codemodel/codemodel/src/main/java/com/sun/codemodel/JDefinedClass.java

@@ -652,7 +652,7 @@ public JDefinedClass _class(int mods, String name)
      *
      * @deprecated
      */
-    @Deprecated
+    @Deprecated(since="4.0.0", forRemoval=true)
     @Override
     public JDefinedClass _class(int mods, String name, boolean isInterface) throws JClassAlreadyExistsException {
     	return _class(mods,name,isInterface?ClassType.INTERFACE:ClassType.CLASS);

jaxb-ri/codemodel/codemodel/src/main/java/com/sun/codemodel/JPackage.java

@@ -143,7 +143,7 @@ public JDefinedClass _class(int mods, String name) throws JClassAlreadyExistsExc
      *
      * @deprecated
      */
-    @Deprecated
+    @Deprecated(since="4.0.0", forRemoval=true)
     @Override
     public JDefinedClass _class( int mods, String name, boolean isInterface ) throws JClassAlreadyExistsException {
         return _class(mods,name, isInterface?ClassType.INTERFACE:ClassType.CLASS );

jaxb-ri/codemodel/codemodel/src/main/java/com/sun/codemodel/JPrimitiveType.java

@@ -79,7 +79,7 @@ public JType unboxify() {
      * @deprecated
      *      Use {@link #boxify()}.
      */
-    @Deprecated
+    @Deprecated(since="4.0.0", forRemoval=true)
     public JClass getWrapperClass() {
         return boxify();
     }

jaxb-ri/core/src/main/java/org/glassfish/jaxb/core/annotation/XmlIsSet.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2021 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2022 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Distribution License v. 1.0, which is available at
@@ -90,7 +90,7 @@
  */
 @Retention(RUNTIME)
 @Target({FIELD,METHOD})
-@Deprecated
+@Deprecated(since="4.0.0", forRemoval=true)
 public @interface XmlIsSet {
     /**
      * Specifies the name of the property to attach to.

jaxb-ri/core/src/main/java/org/glassfish/jaxb/core/marshaller/DataWriter.java

@@ -16,7 +16,8 @@
 
 import java.io.IOException;
 import java.io.Writer;
-import java.util.Stack;
+import java.util.Deque;
+import java.util.LinkedList;
 
 import org.xml.sax.Attributes;
 import org.xml.sax.SAXException;
@@ -131,7 +132,7 @@ public DataWriter (Writer writer, String encoding ) {
      * @deprecated
      *      Only return the length of the indent string.
      */
-    @Deprecated
+    @Deprecated(since="4.0.0", forRemoval=true)
     public int getIndentStep ()
     {
         return indentStep.length();
@@ -148,7 +149,7 @@ public int getIndentStep ()
      * @deprecated
      *      Should use the version that takes string.
      */
-    @Deprecated
+    @Deprecated(since="4.0.0", forRemoval=true)
     public void setIndentStep (int indentStep)
     {
         StringBuilder buf = new StringBuilder();
@@ -180,7 +181,7 @@ public void reset ()
     {
         depth = 0;
         state = SEEN_NOTHING;
-        stateStack = new Stack<>();
+        stateLinkedList = new LinkedList<>();
         super.reset();
     }
 
@@ -215,7 +216,7 @@ public void startElement (String uri, String localName,
                               String qName, Attributes atts)
         throws SAXException
     {
-        stateStack.push(SEEN_ELEMENT);
+        stateLinkedList.push(SEEN_ELEMENT);
         state = SEEN_NOTHING;
         if (depth > 0) {
             super.characters("\n");
@@ -254,7 +255,7 @@ public void endElement (String uri, String localName, String qName)
             doIndent();
         }
         super.endElement(uri, localName, qName);
-        state = stateStack.pop();
+        state = stateLinkedList.pop();
     }
 
     @Override
@@ -359,7 +360,7 @@ private void doIndent ()
     ////////////////////////////////////////////////////////////////////
 
     private Object state = SEEN_NOTHING;
-    private Stack<Object> stateStack = new Stack<>();
+    private Deque<Object> stateLinkedList = new LinkedList<>();
 
     private String indentStep = "";
     private int depth = 0;

jaxb-ri/core/src/main/java/org/glassfish/jaxb/core/marshaller/SAX2DOMEx.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2021 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2022 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Distribution License v. 1.0, which is available at
@@ -10,7 +10,8 @@
 
 package org.glassfish.jaxb.core.marshaller;
 
-import java.util.Stack;
+import java.util.Deque;
+import java.util.LinkedList;
 
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
@@ -37,7 +38,7 @@ public class SAX2DOMEx implements ContentHandler {
 
     private Node node = null;
     private boolean isConsolidate;
-    protected final Stack<Node> nodeStack = new Stack<>();
+    protected final Deque<Node> nodeLinkedList = new LinkedList<>();
     private final FinalArrayList<String> unprocessedNamespaces = new FinalArrayList<>();
     /**
      * Document object that owns the specified node.
@@ -59,7 +60,7 @@ public SAX2DOMEx(Node node) {
     public SAX2DOMEx(Node node, boolean isConsolidate) {
         this.node = node;
         this.isConsolidate = isConsolidate;
-        nodeStack.push(this.node);
+        nodeLinkedList.push(this.node);
 
         if (node instanceof Document) {
             this.document = (Document) node;
@@ -75,25 +76,25 @@ public SAX2DOMEx(DocumentBuilderFactory f) throws ParserConfigurationException {
         f.setValidating(false);
         document = f.newDocumentBuilder().newDocument();
         node = document;
-        nodeStack.push(document);
+        nodeLinkedList.push(document);
     }
 
     /**
      * Creates a fresh empty DOM document and adds nodes under this document.
      * @deprecated
      */
-    @Deprecated
+    @Deprecated(since="4.0.0", forRemoval=true)
     public SAX2DOMEx() throws ParserConfigurationException {
         DocumentBuilderFactory factory = XmlFactory.createDocumentBuilderFactory(false);
         factory.setValidating(false);
 
         document = factory.newDocumentBuilder().newDocument();
         node = document;
-        nodeStack.push(document);
+        nodeLinkedList.push(document);
     }
 
     public final Element getCurrentElement() {
-        return (Element) nodeStack.peek();
+        return (Element) nodeLinkedList.peek();
     }
 
     public Node getDOM() {
@@ -136,7 +137,7 @@ protected void namespace(Element element, String prefix, String uri) {
 
     @Override
     public void startElement(String namespace, String localName, String qName, Attributes attrs) {
-        Node parent = nodeStack.peek();
+        Node parent = nodeLinkedList.peek();
 
         // some broken DOM implementation (we confirmed it with SAXON)
         // return null from this method.
@@ -173,12 +174,12 @@ public void startElement(String namespace, String localName, String qName, Attri
         // append this new node onto current stack node
         parent.appendChild(element);
         // push this node onto stack
-        nodeStack.push(element);
+        nodeLinkedList.push(element);
     }
 
     @Override
     public void endElement(String namespace, String localName, String qName) {
-        nodeStack.pop();
+        nodeLinkedList.pop();
     }
 
     @Override
@@ -187,7 +188,7 @@ public void characters(char[] ch, int start, int length) {
     }
 
     protected Text characters(String s) {
-        Node parent = nodeStack.peek();
+        Node parent = nodeLinkedList.peek();
         Node lastChild = parent.getLastChild();
         Text text;
         if (isConsolidate && lastChild != null && lastChild.getNodeType() == Node.TEXT_NODE) {
@@ -206,7 +207,7 @@ public void ignorableWhitespace(char[] ch, int start, int length) {
 
     @Override
     public void processingInstruction(String target, String data) throws org.xml.sax.SAXException {
-        Node parent = nodeStack.peek();
+        Node parent = nodeLinkedList.peek();
         Node n = document.createProcessingInstruction(target, data);
         parent.appendChild(n);
     }

jaxb-ri/core/src/main/java/org/glassfish/jaxb/core/v2/util/XmlFactory.java

@@ -72,6 +72,9 @@ private static boolean isXMLSecurityDisabled(boolean runtimeSetting) {
     public static SchemaFactory createSchemaFactory(final String language, boolean disableSecureProcessing) throws IllegalStateException {
         try {
             SchemaFactory factory = SchemaFactory.newInstance(language);
+            //https://rules.sonarsource.com/java/RSPEC-2755
+            factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+            factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
             if (LOGGER.isLoggable(Level.FINE)) {
                 LOGGER.log(Level.FINE, "SchemaFactory instance: {0}", factory);
             }
@@ -94,6 +97,9 @@ public static SchemaFactory createSchemaFactory(final String language, boolean d
     public static SAXParserFactory createParserFactory(boolean disableSecureProcessing) throws IllegalStateException {
         try {
             SAXParserFactory factory = SAXParserFactory.newInstance();
+            //https://rules.sonarsource.com/java/RSPEC-2755
+            factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
             if (LOGGER.isLoggable(Level.FINE)) {
                 LOGGER.log(Level.FINE, "SAXParserFactory instance: {0}", factory);
             }
@@ -137,6 +143,10 @@ public static XPathFactory createXPathFactory(boolean disableSecureProcessing) t
     public static TransformerFactory createTransformerFactory(boolean disableSecureProcessing) throws IllegalStateException {
         try {
             TransformerFactory factory = TransformerFactory.newInstance();
+            //https://rules.sonarsource.com/java/RSPEC-2755
+            factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+            //ACCESS_EXTERNAL_SCHEMA not supported in several TransformerFactory implementations
+            factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
             if (LOGGER.isLoggable(Level.FINE)) {
                 LOGGER.log(Level.FINE, "TransformerFactory instance: {0}", factory);
             }
@@ -159,6 +169,9 @@ public static TransformerFactory createTransformerFactory(boolean disableSecureP
     public static DocumentBuilderFactory createDocumentBuilderFactory(boolean disableSecureProcessing) throws IllegalStateException {
         try {
             DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+            //https://rules.sonarsource.com/java/RSPEC-2755
+            factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+            factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
             if (LOGGER.isLoggable(Level.FINE)) {
                 LOGGER.log(Level.FINE, "DocumentBuilderFactory instance: {0}", factory);
             }

jaxb-ri/external/relaxng-datatype/src/main/java/com/sun/tools/rngdatatype/helpers/DatatypeLibraryLoader.java

@@ -43,10 +43,11 @@
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.Reader;
-import java.io.UnsupportedEncodingException;
 import java.net.URL;
 import java.nio.charset.StandardCharsets;
 import java.util.Enumeration;
+import java.util.LinkedList;
+import java.util.List;
 import java.util.NoSuchElementException;
 import java.util.Vector;
 
@@ -81,7 +82,7 @@ private static class Service {
 	  private final Class serviceClass;
 	  private final Enumeration configFiles;
 	  private Enumeration classNames = null;
-	  private final Vector providers = new Vector();
+	  private final List providers = new LinkedList();
 	  private Loader loader;
 
 	  private class ProviderEnumeration implements Enumeration {
@@ -93,7 +94,7 @@ public boolean hasMoreElements() {
 
 	    public Object nextElement() {
 	      try {
-		return providers.elementAt(nextIndex++);
+		return providers.get(nextIndex++);
 	      }
 	      catch (ArrayIndexOutOfBoundsException e) {
 		throw new NoSuchElementException();
@@ -198,7 +199,7 @@ synchronized private boolean moreProviders() {
 		  Class<?> cls = loader.loadClass(className);
 		  Object obj = cls.getConstructor().newInstance();
 		  if (serviceClass.isInstance(obj)) {
-		    providers.addElement(obj);
+		    providers.add(obj);
 		    return true;
 		  }
 		}
@@ -218,7 +219,7 @@ private static Enumeration parseConfigFile(URL url) {
 	      Reader r;
             r = new InputStreamReader(in, StandardCharsets.UTF_8);
             r = new BufferedReader(r);
-	      Vector tokens = new Vector();
+	      List tokens = new LinkedList();
 	      StringBuilder tokenBuf = new StringBuilder();
 	      int state = START;
 	      for (;;) {
@@ -245,13 +246,13 @@ private static Enumeration parseConfigFile(URL url) {
 		  break;
 		}
 		if (tokenBuf.length() != 0 && state != IN_NAME) {
-		  tokens.addElement(tokenBuf.toString());
+		  tokens.add(tokenBuf.toString());
 		  tokenBuf.setLength(0);
 		}
 	      }
 	      if (tokenBuf.length() != 0)
-		tokens.addElement(tokenBuf.toString());
-	      return tokens.elements();
+		tokens.add(tokenBuf.toString());
+	      return new Vector<>(tokens).elements();//NOSONAR
 	    }
 	    catch (IOException e) {
 	      return null;

jaxb-ri/external/relaxng-datatype/src/main/java/com/sun/tools/rngdatatype/helpers/StreamingValidatorImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, 2010, Thai Open Source Software Center Ltd
+ * Copyright (c) 2005, 2010, 2022, Thai Open Source Software Center Ltd
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -64,7 +64,7 @@
 public final class StreamingValidatorImpl implements DatatypeStreamingValidator {
 
 	/** This buffer accumulates characters. */
-	private final StringBuffer buffer = new StringBuffer();
+	private final StringBuilder buffer = new StringBuilder();
 
 	/** Datatype obejct that creates this streaming validator. */
 	private final Datatype baseType;

jaxb-ri/external/rngom/src/main/java/com/sun/tools/rngom/ast/builder/IncludedGrammar.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2015
+ * Copyright (C) 2004-2022
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -24,7 +24,6 @@
 import com.sun.tools.rngom.ast.om.ParsedElementAnnotation;
 import com.sun.tools.rngom.ast.om.Location;
 import com.sun.tools.rngom.ast.om.ParsedPattern;
-import com.sun.tools.rngom.parse.Parseable;
 
 /**
  * {@link Scope} for {@code <grammar>} element of the {@code <include>}d grammar.