【发布时间】:2020-01-03 15:27:03
【问题描述】:
最近,我在 Java MVC 框架中编写了一个简单的游戏,一位高级程序员在审查时告诉我,使用 score 是不安全的,它的 getter 和 setter 在玩家模型本身中定义。不幸的是,我无法从他们那里获得更多信息,说明它是如何以及为什么看起来如此,我无法弄清楚为什么。
有人可以查看这些类并指出为什么不建议使用这种架构吗?
播放器模型:
public class player implements Comparable<player>{
private int score;
private int consecutive_misses;
private String name;
private int foul_count;
private int turn;
private boolean win;
public player()
{
this.score=0;
this.consecutive_misses=0;
this.foul_count=0;
this.win=false;
}
public void setWin(boolean win)
{
this.win=win;
}
public boolean getWin()
{
return this.win;
}
public void setPlayerName(String name)
{
this.name=name;
}
public void setTurn(int turn)
{
this.turn=turn;
}
public int getTurn()
{
return this.turn;
}
public void addScore(int score)
{
this.score+=score;
}
public String getName()
{
return this.name;
}
public int getScore(){
return this.score;
}
public void resetFoulCount() {
this.foul_count = 0;
}
public void incrementFoulCount() {
this.foul_count++;
}
public int getFoulCount()
{
return this.foul_count;
}
public void resetConsecutiveMisses() {
this.consecutive_misses = 0;
}
public void incrementConsecutiveMisses() {
this.consecutive_misses++;
}
public int getConsecutiveMisses()
{
return this.consecutive_misses;
}
public int compareTo(player comparePlayer)
{
int compareScore=((player) comparePlayer).getScore();
return compareScore-this.score;
}
}```
the main game model class where i implemented player model
package com.tiffany.CleanStrike_1.models;
import java.util.HashMap;
import java.util.Map;
public class gameModel {
private int player_count;
private player[] players;
private player current_player;
private player winner=new player();
private gameState game_state;
private boolean draw=false;
private carromBoard carrom_board;
public gameModel(int player_count,int black_coin_count,int red_coin_count,int black_val,int red_val)
{
this.game_state=gameState.DORMANT;
this.players=new player[player_count];
for(int i=0;i<player_count;i++)
{
this.players[i]=new player();
}
this.setPlayerCount(player_count);
Coin black_coin=new Coin(CoinColour.BLACK,black_val);
carrom_board=new carromBoard();
this.carrom_board.addCoin(black_coin,black_coin_count);
Coin red_coin=new Coin(CoinColour.RED,red_val);
this.carrom_board.addCoin(red_coin,red_coin_count);
}
public int getNoOfCoins(CoinColour colour)
{
Map<Coin,Integer> coins=new HashMap<Coin,Integer>();
coins=this.getCoinsOnBoard();
for(Coin coin: coins.keySet())
{
if(coin.getColour()==colour)
return coins.get(coin);
}
return 0;
}
public void setPlayerName(int i,String name)
{
this.players[i].setPlayerName(name);
}
public void setGameDraw()
{
this.draw=true;
}
public boolean getGameDraw()
{
return this.draw;
}
public void setGameState(gameState game_s)
{
this.game_state=game_s;
}
public gameState getGameState()
{
return this.game_state;
}
public int getCountOfAllCoins()
{
return this.carrom_board.getCountOfAllCoins();
}
public int getCoinValue(CoinColour colour)
{
for ( Coin coin : this.carrom_board.getCoins().keySet() ) {
if(coin.getColour()==colour) {
return coin.getValue();
}
}
return 0;
}
public void setWinner(player w)
{
this.winner=w;
}
public player getWinner()
{
return this.winner;
}
public void setCurrentPlayer(player p)
{
this.current_player=p;
}
public player getCurrentPlayer()
{
return this.current_player;
}
public void setPlayerCount(int count)
{
this.player_count=count;
}
public int getPlayerCount()
{
return this.player_count;
}
public Map<Coin,Integer> getCoinsOnBoard()
{
return this.carrom_board.getCoins();
}
public void removeCoin(CoinColour colour,int count)
{
this.carrom_board.removeCoin(colour, count);
}
public player[] getPlayers()
{
return this.players;
}
}
【问题讨论】:
-
考虑在Code Review 提问。并考虑再次询问高级工程师 - 教育更多初级工程师是他工作的一部分。
-
从技术上讲,如果您允许为玩家设置分数,这意味着任何持有该玩家的人都可以这样做,而系统的其他部分不知道分数的来源。分数应该从系统的中心点分发,并且从任何玩家的角度来看都应该是只读的。我什至会争辩说,分数不是玩家的属性,它是你可以从游戏或规则对象中询问的东西。但是你绝对应该问你的前辈他们的意思,我们不是说当前设计不适合目的的人。
-
这些在您的代码中都是有效的:
player.setPlayerName(null); player.setTurn(-10000); model.setWinner(new Player()); model.setCurrentPlayer(null); model.getPlayers()[0]=null;换句话说,根本不进行任何检查,从而损害了类的约束/不变量。如果不确保这些约束,程序崩溃时很难查明原因。
标签: java security model-view-controller model