ThrawnCA

I would say that yes, defining a private method in an anonymous class and then calling it is abnormal. The class is anonymous, what's the point of `private`? The second...

The intent of MSF_MUTABLE_SERVLET_FIELD is to entirely discourage the use of mutable fields in servlets. In this case, although you have addressed the possibility of race conditions, it might be...

Are you able to provide the (bytecode) output of `javap -v`? It looks like this code depends on your other classes, so would be difficult for someone else to compile.

> PMD should have reported I think you mean SpotBugs?

Assertions are not always enforced, so SpotBugs isn't necessarily wrong to ignore them. What code is there to ensure that the thread will, in fact, hold the lock, and that...

Yes, `finalize` methods should probably be allowed to throw `Throwable` without flagging the detector. You could use an exclude rule in the meantime?

> hey I am new here I would like to contribute here can you tell me how can I get started Commenting on a random issue isn't really the right...

If you're using a parameter to assemble the filename, that doesn't sound like hardcoding. See https://github.com/spotbugs/spotbugs/blob/51e586bed98393e53559a38c1f9bd15f54514efa/spotbugs/src/main/java/edu/umd/cs/findbugs/detect/DumbMethodInvocations.java#L141

Technically yes, that is a situation where the filename is hardcoded, but it's a bit contrived, assembling it from two pieces that are both literal strings. If you would like...

It's also possible for the proxy itself to rewrite cookies as needed. Apache example: ``` Header always edit Set-Cookie ^(.*)$ $1;Secure ``` HAProxy: ``` rsprep (Set\ Cookie:.*) \1;Secure ```