palantir / palantir/conjure-java
Object builders allow sneaky mutations of maps inside created POJOs
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 39
- Forks
- 49
- Avg merge
- 8h 22m
- Merged PRs (30d)
- 32
Description
conjure-java generates Builder classes for plain object types, which contain mutable collections (e.g. HashMap, ArrayList, HashSet). In the .build() method, we pass these mutable collections to the POJO's constructor, which uses Collections.unmodifiableMap(...) to prevent mutations from POJO methods HOWEVER, the builder still has references to the underlying mutable collections, so these can still be mutated!
Foo:
fields:
keys: map<string, integer>
@Test
public void sad() {
Foo.Builder builder = Foo.builder();
Foo schema = builder.build(); // create a Foo containing an empty 'keys' map
builder.keys("this call mutates a underlying list", 1234);
assertThat(schema.getKeys()).isEmpty(); // <- 🔥🔥 this fails
}
Reported by @j-baker
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the generated Builder's .build() method and reproduce the issue with the Foo YAML example and its mutable keys map. Done means mutating the builder after build no longer changes the already-created POJO; add a regression test covering that behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100