| Wiki Markup |
|---|
Callers can trivially access and modify {{public}} {{static}} non-final fields. Neither accesses nor any modifications are checked by a security manager, and newly set values cannot be validated. Classes loaded by the same or different class loaders can access each others' {{public static}} members, unless appropriate protection is installed. For example, consider Java applets \[[Sun 2008|AA. Bibliography#Sun 08]\]: |
...
Unauthorized modifications of public static variables can result in unexpected behavior and violation of class invariants. Further, because static variables are global across the Java Runtime Environment (JRE), they can be used as a covert communication channel between different application domains (e.g., through code loaded by different class loaders).
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
OBJ03-J | medium | probable | medium | P8 | L2 |
...
| Wiki Markup |
|---|
\[[FT 2008|AA. Bibliography#FT 08]\] \[[Sterbenz 2006|AA. Bibliography#Sterbenz 06]\] Antipattern 5, Misusing Public Static Variables \[[Nisewanger 2007|AA. Bibliography#Nisewanger 07]\] Antipattern 5, Misusing Public Static Variables \[[SCG 2007|AA. Bibliography#SCG 07]\] Guideline 3.1, Treat public static fields as constants \[[Gong 2003|AA. Bibliography#Gong 03]\] 9.3 Static Fields \[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 582|http://cwe.mitre.org/data/definitions/582.html] "Array Declared Public, Final, and Static", [CWE ID 493|http://cwe.mitre.org/data/definitions/493.html] "Critical Public Variable Without Final Modifier", [CWE ID 500|http://cwe.mitre.org/data/definitions/500.html] "Public Static Field Not Marked Final" \[[Nisewanger 2007|AA. Bibliography#Nisewanger 07]\] Antipattern 5, Misusing Public Static Variables \[[SCG 2007|AA. Bibliography#SCG 07]\] Guideline 3.1, Treat public static fields as constants \[[Sterbenz 2006|AA. Bibliography#Sterbenz 06]\] Antipattern 5, Misusing Public Static Variables |
...
OBJ02-J. Do not ignore return values of methods that operate on immutable objects 08. Object Orientation (OBJ) OBJ04-J. Do not allow partially initialized objects to be accessed