Rule for Request #707: AvoidRecreatingMessageDigests - MessageDigest.getInstance is expensive because of classloading

[jborgers]

No description provided.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[stokpop]

Some questions and possible improvements.

[stokpop]

Document why these two method prefixes sha and md are ok. Not too brittle? There are also shake prefixes in DigestUtils... oh those also start with sha.

[Copilot]

Pull request overview

Adds the AvoidRecreatingMessageDigests PMD rule requested in issue #707.

Changes:

• Detects repeated MessageDigest and DigestUtils creation.
• Adds rule tests and documentation.
• Publishes the rule across distributed rulesets.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/main/resources/category/java/common.xml	Defines the XPath rule.
rulesets/java/jpinpoint-rules.xml	Adds the distributed rule.
rulesets/java/jpinpoint-java-rules.xml	Adds the Java ruleset copy.
src/test/java/.../AvoidRecreatingMessageDigestsTest.java	Adds the PMD test harness.
src/test/resources/.../AvoidRecreatingMessageDigests.xml	Adds positive and negative cases.
docs/JavaCodePerformance.md	Documents the performance guidance.

Suppressed comments (1)

src/test/resources/com/jpinpoint/perf/lang/java/ruleset/common/xml/AvoidRecreatingMessageDigests.xml:59

• This negative case returns updateDigest directly, so it never exercises the XPath branch that matches a DigestUtils call inside a MessageDigest local declaration. Assign the returned (same) digest to a local first; the current rule will then expose its false positive and the corrected signature-based selector will keep the case clean.

    MessageDigest good3DigestUtils() {
        MessageDigest mdLocal = mdField.clone();
        return DigestUtils.updateDigest(mdLocal, dataToDigest);
    }

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.