Spring Non Void Initbinder

ID

java.spring_non_void_initbinder

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

best-practice, spring

Description

Reports @InitBinder methods that do not return void. Spring MVC requires @InitBinder methods to be void — a non-void return type is silently ignored and signals a misunderstanding of the annotation contract.

Rationale

Reliability — The return value is never used by Spring MVC. A non-void return type may indicate the developer confused @InitBinder with a request-mapping method.

Remediation

Non-compliant code

@InitBinder
public String initBinder(WebDataBinder binder) {
    binder.setDisallowedFields("id");
    return "ok"; // return value is silently ignored
}

Compliant code

@InitBinder
public void initBinder(WebDataBinder binder) {
    binder.setDisallowedFields("id");
}

References