Fix Sonar vulnerabilities for varargs

* Fix smell for static `AmqpInboundGateway.attributesHolder`

* Fix readOnlyHeaders in the `MessageBuilder`

spring-integration-http/src/main/java/org/springframework/integration/http/inbound/CrossOrigin.java

@@ -16,6 +16,8 @@
 
 package org.springframework.integration.http.inbound;
 
+import java.util.Arrays;
+
 import org.springframework.web.bind.annotation.RequestMethod;
 
 /**
@@ -24,26 +26,28 @@ import org.springframework.web.bind.annotation.RequestMethod;
  * {@link org.springframework.web.bind.annotation.CrossOrigin}.
  *
  * @author Artem Bilan
+ *
  * @since 4.2
+ *
  * @see org.springframework.web.bind.annotation.CrossOrigin
  * @see IntegrationRequestMappingHandlerMapping
  */
 public class CrossOrigin {
 
-	private String[] origin = {"*"};
+	private String[] origin = { "*" };
 
-	private String[] allowedHeaders = {"*"};
+	private String[] allowedHeaders = { "*" };
 
-	private String[] exposedHeaders = {};
+	private String[] exposedHeaders = { };
 
-	private RequestMethod[] method = {};
+	private RequestMethod[] method = { };
 
 	private Boolean allowCredentials = true;
 
 	private long maxAge = 1800;
 
 	public void setOrigin(String... origin) {
-		this.origin = origin;
+		this.origin = Arrays.copyOf(origin, origin.length);
 	}
 
 	public String[] getOrigin() {
@@ -51,7 +55,7 @@ public class CrossOrigin {
 	}
 
 	public void setAllowedHeaders(String... allowedHeaders) {
-		this.allowedHeaders = allowedHeaders;
+		this.allowedHeaders = Arrays.copyOf(allowedHeaders, allowedHeaders.length);
 	}
 
 	public String[] getAllowedHeaders() {
@@ -59,7 +63,7 @@ public class CrossOrigin {
 	}
 
 	public void setExposedHeaders(String... exposedHeaders) {
-		this.exposedHeaders = exposedHeaders;
+		this.exposedHeaders = Arrays.copyOf(exposedHeaders, exposedHeaders.length);
 	}
 
 	public String[] getExposedHeaders() {
@@ -67,7 +71,7 @@ public class CrossOrigin {
 	}
 
 	public void setMethod(RequestMethod... method) {
-		this.method = method;
+		this.method = Arrays.copyOf(method, method.length);
 	}
 
 	public RequestMethod[] getMethod() {

spring-integration-http/src/main/java/org/springframework/integration/http/inbound/RequestMapping.java

@@ -16,6 +16,8 @@
 
 package org.springframework.integration.http.inbound;
 
+import java.util.Arrays;
+
 import org.springframework.http.HttpMethod;
 import org.springframework.util.Assert;
 import org.springframework.web.bind.annotation.RequestMethod;
@@ -26,6 +28,7 @@ import org.springframework.web.bind.annotation.RequestMethod;
  * {@link org.springframework.web.bind.annotation.RequestMapping}.
  *
  * @author Artem Bilan
+ *
  * @since 3.0
  *
  * @see org.springframework.web.bind.annotation.RequestMapping
@@ -37,15 +40,15 @@ public class RequestMapping {
 
 	private String[] pathPatterns;
 
-	private HttpMethod[] methods = new HttpMethod[]{HttpMethod.GET, HttpMethod.POST};
+	private HttpMethod[] methods = { HttpMethod.GET, HttpMethod.POST };
 
-	private String[] params = new String[0];
+	private String[] params = { };
 
-	private String[] headers = new String[0];
+	private String[] headers = { };
 
-	private String[] consumes = new String[0];
+	private String[] consumes = { };
 
-	private String[] produces = new String[0];
+	private String[] produces = { };
 
 	public String getName() {
 		return this.name;
@@ -57,7 +60,7 @@ public class RequestMapping {
 
 	public void setPathPatterns(String... pathPatterns) {
 		Assert.notEmpty(pathPatterns, "at least one path pattern is required");
-		this.pathPatterns = pathPatterns;
+		this.pathPatterns = Arrays.copyOf(pathPatterns, pathPatterns.length);
 	}
 
 	public String[] getPathPatterns() {
@@ -66,7 +69,7 @@ public class RequestMapping {
 
 	public void setMethods(HttpMethod... supportedMethods) {
 		Assert.notEmpty(supportedMethods, "at least one supported methods is required");
-		this.methods = supportedMethods;
+		this.methods = Arrays.copyOf(supportedMethods, supportedMethods.length);
 	}
 
 	public HttpMethod[] getMethods() {
@@ -75,7 +78,7 @@ public class RequestMapping {
 
 	public void setParams(String... params) {
 		Assert.notEmpty(params, "at least one param is required");
-		this.params = params;
+		this.params = Arrays.copyOf(params, params.length);
 	}
 
 	public String[] getParams() {
@@ -84,7 +87,7 @@ public class RequestMapping {
 
 	public void setHeaders(String... headers) {
 		Assert.notEmpty(headers, "at least one header is required");
-		this.headers = headers;
+		this.headers = Arrays.copyOf(headers, headers.length);
 	}
 
 	public String[] getHeaders() {
@@ -93,7 +96,7 @@ public class RequestMapping {
 
 	public void setConsumes(String... consumes) {
 		Assert.notEmpty(consumes, "at least one consume value is required");
-		this.consumes = consumes;
+		this.consumes = Arrays.copyOf(consumes, consumes.length);
 	}
 
 	public String[] getConsumes() {
@@ -102,7 +105,7 @@ public class RequestMapping {
 
 	public void setProduces(String... produces) {
 		Assert.notEmpty(produces, "at least one produce value is required");
-		this.produces = produces;
+		this.produces = Arrays.copyOf(produces, produces.length);
 	}
 
 	public String[] getProduces() {

spring-integration-http/src/main/java/org/springframework/integration/http/support/DefaultHttpHeaderMapper.java

@@ -405,77 +405,79 @@ public class DefaultHttpHeaderMapper implements HeaderMapper<HttpHeaders>, BeanF
 
 	private static final String PRAGMA_LOWER = "pragma";
 
-	private static final String[] HTTP_REQUEST_HEADER_NAMES = new String[] {
-			HttpHeaders.ACCEPT,
-			HttpHeaders.ACCEPT_CHARSET,
-			HttpHeaders.ACCEPT_ENCODING,
-			HttpHeaders.ACCEPT_LANGUAGE,
-			HttpHeaders.ACCEPT_RANGES,
-			HttpHeaders.AUTHORIZATION,
-			HttpHeaders.CACHE_CONTROL,
-			HttpHeaders.CONNECTION,
-			HttpHeaders.CONTENT_LENGTH,
-			HttpHeaders.CONTENT_TYPE,
-			HttpHeaders.COOKIE,
-			HttpHeaders.DATE,
-			HttpHeaders.EXPECT,
-			HttpHeaders.FROM,
-			HttpHeaders.HOST,
-			HttpHeaders.IF_MATCH,
-			HttpHeaders.IF_MODIFIED_SINCE,
-			HttpHeaders.IF_NONE_MATCH,
-			HttpHeaders.IF_RANGE,
-			HttpHeaders.IF_UNMODIFIED_SINCE,
-			HttpHeaders.MAX_FORWARDS,
-			HttpHeaders.PRAGMA,
-			HttpHeaders.PROXY_AUTHORIZATION,
-			HttpHeaders.RANGE,
-			HttpHeaders.REFERER,
-			HttpHeaders.TE,
-			HttpHeaders.UPGRADE,
-			HttpHeaders.USER_AGENT,
-			HttpHeaders.VIA,
-			HttpHeaders.WARNING
-	};
+	private static final String[] HTTP_REQUEST_HEADER_NAMES =
+			{
+					HttpHeaders.ACCEPT,
+					HttpHeaders.ACCEPT_CHARSET,
+					HttpHeaders.ACCEPT_ENCODING,
+					HttpHeaders.ACCEPT_LANGUAGE,
+					HttpHeaders.ACCEPT_RANGES,
+					HttpHeaders.AUTHORIZATION,
+					HttpHeaders.CACHE_CONTROL,
+					HttpHeaders.CONNECTION,
+					HttpHeaders.CONTENT_LENGTH,
+					HttpHeaders.CONTENT_TYPE,
+					HttpHeaders.COOKIE,
+					HttpHeaders.DATE,
+					HttpHeaders.EXPECT,
+					HttpHeaders.FROM,
+					HttpHeaders.HOST,
+					HttpHeaders.IF_MATCH,
+					HttpHeaders.IF_MODIFIED_SINCE,
+					HttpHeaders.IF_NONE_MATCH,
+					HttpHeaders.IF_RANGE,
+					HttpHeaders.IF_UNMODIFIED_SINCE,
+					HttpHeaders.MAX_FORWARDS,
+					HttpHeaders.PRAGMA,
+					HttpHeaders.PROXY_AUTHORIZATION,
+					HttpHeaders.RANGE,
+					HttpHeaders.REFERER,
+					HttpHeaders.TE,
+					HttpHeaders.UPGRADE,
+					HttpHeaders.USER_AGENT,
+					HttpHeaders.VIA,
+					HttpHeaders.WARNING
+			};
 
 	private static final Set<String> HTTP_REQUEST_HEADER_NAMES_LOWER = new HashSet<>();
 
-	private static final String[] HTTP_RESPONSE_HEADER_NAMES = new String[] {
-			HttpHeaders.ACCEPT_RANGES,
-			HttpHeaders.AGE,
-			HttpHeaders.ALLOW,
-			HttpHeaders.CACHE_CONTROL,
-			HttpHeaders.CONNECTION,
-			HttpHeaders.CONTENT_ENCODING,
-			HttpHeaders.CONTENT_LANGUAGE,
-			HttpHeaders.CONTENT_LENGTH,
-			HttpHeaders.CONTENT_LOCATION,
-			CONTENT_MD5,
-			HttpHeaders.CONTENT_RANGE,
-			HttpHeaders.CONTENT_TYPE,
-			HttpHeaders.CONTENT_DISPOSITION,
-			HttpHeaders.TRANSFER_ENCODING,
-			HttpHeaders.DATE,
-			HttpHeaders.ETAG,
-			HttpHeaders.EXPIRES,
-			HttpHeaders.LAST_MODIFIED,
-			HttpHeaders.LOCATION,
-			HttpHeaders.PRAGMA,
-			HttpHeaders.PROXY_AUTHENTICATE,
-			REFRESH,
-			HttpHeaders.RETRY_AFTER,
-			HttpHeaders.SERVER,
-			HttpHeaders.SET_COOKIE,
-			HttpHeaders.TRAILER,
-			HttpHeaders.VARY,
-			HttpHeaders.VIA,
-			HttpHeaders.WARNING,
-			HttpHeaders.WWW_AUTHENTICATE
-	};
+	private static final String[] HTTP_RESPONSE_HEADER_NAMES =
+			{
+					HttpHeaders.ACCEPT_RANGES,
+					HttpHeaders.AGE,
+					HttpHeaders.ALLOW,
+					HttpHeaders.CACHE_CONTROL,
+					HttpHeaders.CONNECTION,
+					HttpHeaders.CONTENT_ENCODING,
+					HttpHeaders.CONTENT_LANGUAGE,
+					HttpHeaders.CONTENT_LENGTH,
+					HttpHeaders.CONTENT_LOCATION,
+					CONTENT_MD5,
+					HttpHeaders.CONTENT_RANGE,
+					HttpHeaders.CONTENT_TYPE,
+					HttpHeaders.CONTENT_DISPOSITION,
+					HttpHeaders.TRANSFER_ENCODING,
+					HttpHeaders.DATE,
+					HttpHeaders.ETAG,
+					HttpHeaders.EXPIRES,
+					HttpHeaders.LAST_MODIFIED,
+					HttpHeaders.LOCATION,
+					HttpHeaders.PRAGMA,
+					HttpHeaders.PROXY_AUTHENTICATE,
+					REFRESH,
+					HttpHeaders.RETRY_AFTER,
+					HttpHeaders.SERVER,
+					HttpHeaders.SET_COOKIE,
+					HttpHeaders.TRAILER,
+					HttpHeaders.VARY,
+					HttpHeaders.VIA,
+					HttpHeaders.WARNING,
+					HttpHeaders.WWW_AUTHENTICATE
+			};
 
 	private static final Set<String> HTTP_RESPONSE_HEADER_NAMES_LOWER = new HashSet<>();
 
-	private static final String[] HTTP_REQUEST_HEADER_NAMES_OUTBOUND_EXCLUSIONS = new String[0];
+	private static final String[] HTTP_REQUEST_HEADER_NAMES_OUTBOUND_EXCLUSIONS = { };
 
 	private static final String[] HTTP_RESPONSE_HEADER_NAMES_INBOUND_EXCLUSIONS =
 			{ HttpHeaders.CONTENT_LENGTH, HttpHeaders.TRANSFER_ENCODING };
@@ -500,17 +502,17 @@ public class DefaultHttpHeaderMapper implements HeaderMapper<HttpHeaders>, BeanF
 		}
 	}
 
-	private volatile String[] outboundHeaderNames = new String[0];
+	private volatile String[] outboundHeaderNames = {};
 
-	private volatile String[] outboundHeaderNamesLowerWithContentType = new String[0];
+	private volatile String[] outboundHeaderNamesLowerWithContentType = {};
 
-	private volatile String[] inboundHeaderNames = new String[0];
+	private volatile String[] inboundHeaderNames = {};
 
-	private volatile String[] inboundHeaderNamesLower = new String[0];
+	private volatile String[] inboundHeaderNamesLower = {};
 
-	private volatile String[] excludedOutboundStandardRequestHeaderNames = new String[0];
+	private volatile String[] excludedOutboundStandardRequestHeaderNames = {};
 
-	private volatile String[] excludedInboundStandardResponseHeaderNames = new String[0];
+	private volatile String[] excludedInboundStandardResponseHeaderNames = {};
 
 	private volatile String userDefinedHeaderPrefix = "";
 
@@ -575,12 +577,12 @@ public class DefaultHttpHeaderMapper implements HeaderMapper<HttpHeaders>, BeanF
 	 * will match the header name prefixed with the value specified by
 	 * {@link DefaultHttpHeaderMapper#setUserDefinedHeaderPrefix(String)}. The default for
 	 * that is an empty String.
-	 * @param inboundHeaderNames The inbound header names.
+	 * @param inboundHeaderNamesArg The inbound header names.
 	 */
-	public void setInboundHeaderNames(String... inboundHeaderNames) {
+	public void setInboundHeaderNames(String... inboundHeaderNamesArg) {
 		this.inboundHeaderNames =
-				inboundHeaderNames != null
-						? Arrays.copyOf(inboundHeaderNames, inboundHeaderNames.length)
+				inboundHeaderNamesArg != null
+						? Arrays.copyOf(inboundHeaderNamesArg, inboundHeaderNamesArg.length)
 						: new String[0];
 		this.inboundHeaderNamesLower = new String[this.inboundHeaderNames.length];
 		for (int i = 0; i < this.inboundHeaderNames.length; i++) {