Thread.dumpStack() In Production
ID |
java.thread_dumpstack_in_production |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
Resource |
Code Smell |
Language |
Java |
Tags |
best-practice, code-style |
Description
Reports calls to Thread.dumpStack(). This static method prints the current thread’s stack trace to System.err and is intended for quick manual debugging, not for production use.
Rationale
Thread.dumpStack() writes directly to System.err, bypassing the application’s logging configuration. In production it creates noise in error streams, may expose internal implementation details, and cannot be controlled by log levels:
public void process() {
Thread.dumpStack(); // Debugging leftover
doWork();
}Remediation
Remove the Thread.dumpStack() call. If you need stack trace information, use a logging framework or a proper profiling tool:
public void process() {
log.debug("Processing started", new Exception("stack trace"));
doWork();
}