Page History

Java 1.5 supports the use of enumerated types; these enums look just like their C and C++ counterparts. But, in In the Java programming language, however, enums are far more powerful than their counterparts in other languages, which are little more than glorified integers. In Java, all enums have an ordinal() method, which returns the numerical position of each enum constant in its class declaration.

The Java Language Specification, in Section 8.9, "Enums" does not specify the use of ordinal() in programs. However, improper use of ordinal() method in program logic can cause errors in programs.

...

It defines use of ordinal() as a helper function to sophisticated enum-based data-structures EnumSet and EnumMap. Poor understanding of ordinal() can cause programs to behave erroneously.

Noncompliant Code Example

This noncomplaint code example declares enum Hydrocarbon and uses its ordinal() method to provide the result of the getNumberOfCarbons() method.

...

While the enum code above works, its maintenance is susceptible to vulnerabilities. If the enum constants are were to be reordered, the getNumberOfCarbon() method does would not return correct values. Also, if{{BENZENE}}, with 6 carbons, is added to the enum, it BENZENE — which also has 6 carbons — cannot be added without violating the current enum design.

Compliant Solution

In this compliant solution, we explicitly associate enum constants with corresponding integer values.

enum HydroCarbon {
  METHANE(1), ETHANE(2), PROPANE(3), BUTANE(4), PENTANE(5),
  HEXANE(6), BENZENE(6), HEPTANE(7), OCTANE(8), NONANE(9), DECANE(10);

  private final int numberOfCarbons;

  Hydrocarbon(int carbons) { this.numberOfCarbons = carbons; }

  public int getNumberOfCarbons() {
    return numberOfCarbons;
  }
}

Risk Assessment

Use of ordinals to derive integer values reduces the program's maintainability and leads can lead to errors in the program.

Related Guidelines

C Secure Coding Standard: INT09-C. Ensure enumeration constants map to unique values

C++ Secure Coding Standard: INT09-CPP. Ensure enumeration constants map to unique values

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

\[[JLS 2005|AA. Bibliography#JLS 05]\] Section 8.9, "Enums"
\[[API 2006|AA. Bibliography#API 06]\] [Enum|http://download.oracle.com/javase/6/docs/api/java/lang/Enum.html]