Invalid Model Attribute Name
ID |
java.spring_model_attribute_name |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
best-practice, reliability, spring |
Description
Reports an addAttribute call on a Spring model whose name is not a valid Java identifier.
Rationale
A view engine resolves a model attribute by name through Spring Expression Language (SpEL) when it renders. SpEL identifiers follow the same rule as Java identifiers: the name must start with a letter, underscore, or dollar sign, and continue with letters, digits, underscores, or dollar signs. A name that starts with a digit, contains a hyphen or a dot, or otherwise breaks that rule parses without error when the attribute is added, and only fails once the view tries to read it back — far from the controller method that introduced the mistake.
Because addAttribute is also a common method name unrelated to Spring, this is only reported when the call’s receiver resolves to a Spring model type (Model, ModelMap, ModelAndView, RedirectAttributes), or — since that type often cannot be resolved from the file alone — when the call sits inside a class annotated @Controller or @RestController. A non-literal first argument is never resolved and is not reported.
// Bad - fails to resolve as SpEL when the view renders
@Controller
public class ReportController {
@GetMapping("/report")
public String showReport(Model model) {
model.addAttribute("report.title", "Q3 Summary");
return "report";
}
}