OWASP / OWASP/SecurityShepherd
Replace inefficient new String() constructors in GetterIT.testSSOAuthExistingUserRelogin
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 515
- Avg merge
- 3h 46m
- Merged PRs (30d)
- 1
Description
Summary
The code-quality bot (CodeQL on #816) flags two "Inefficient String constructor" instances in src/it/java/dbProcs/GetterIT.java, inside testSSOAuthExistingUserRelogin():
String userName = new String("SSOReloginUser Lastname");→String userName = "SSOReloginUser Lastname";String ssoName = new String("ssoreloginuser@example.com");→String ssoName = "ssoreloginuser@example.com";
new String("literal") creates a redundant object; assign the literal directly. No behavior change, no new imports.
Severity
Trivial — test-only, micro-efficiency. Good first issue.
Acceptance criteria
- Both
new String("...")calls intestSSOAuthExistingUserRelogin()replaced with direct literal assignment. -
GetterITstill passes; code-quality alerts cleared.
Context
Surfaced while reviewing the code-quality bot output on #816. Out of scope for the connection-pooling work; filed as a standalone follow-up. Not a blocker for #816.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open src/it/java/dbProcs/GetterIT.java and locate testSSOAuthExistingUserRelogin(). Replace the two specified new String(...) assignments with direct literals, then run GetterIT and confirm the code-quality alerts are cleared.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- testing-qa
- Issue type
- Refactor
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100