Page History

...

In the presence of multiple threads, non-final public static fields can be modified in inconsistent ways . (For an example, see guideline TSM01-J. Do not let the (this) reference escape during object construction for an example.)

Improper use of {{public static}} fields can also result in type safety issues. For example, untrusted code can supply an unexpected subtype when the variable is defined to be of a more general type, such as {{java.lang.Object}} \[[Gong 2003|AA. Bibliography#Gong 03]\].

...

Replacing the function table gives the attacker access to XPathContext, which is used to set the reference node for evaluating XPath expressions. Manipulating it XPathContext can allow cause XML fields to be modified in inconsistent ways, resulting in unexpected behavior. Also, because static variables are global across the Java Runtime Environment ( JRE), they can be used as a covert communication channel between different application domains (for example, through code loaded by different class loaders).

...

Fields declared static final are also safe for multithreaded use ; (see guideline TSM03-J. Do not publish partially initialized objects.) However, remember that simply changing the modifier to final may not prevent attackers from indirectly retrieving an incorrect value from the static final variable before its initialization ; (see guideline DCL12-J. Prevent class initialization cycles for more information.) Furthermore, individual members of the referenced object can also be changed if the object itself is mutable ; (see guideline OBJ01-J. Never conflate immutability of a reference with that of the referenced object.)

It is also permissible to use a wrapper method to retrieve the value of m_functions. This has encapsulation advantages as it permits m_functions to be declared private. See guideline OBJ00-J. Declare data members as private and provide accessible wrapper methods for more information.

...

Unauthorized modifications of public static variables can result in unexpected behavior and violation of class invariants. Furthermore, because static variables can be visible to code loaded by different class loaders when those class loaders are in the same delegation chain, such variables can be used as a covert communication channel between different application domains in some cases. For more information, see ???.

...

[MITRE CWE|http://cwe.mitre.org/]: [CWE-582|http://cwe.mitre.org/data/definitions/582.html] "Array Declared Public, Final, and Static"
[MITRE CWE|http://cwe.mitre.org/]:," [CWE-493|http://cwe.mitre.org/data/definitions/493.html] "Critical Public Variable Without Final Modifier,"
[MITRE CWE|http://cwe.mitre.org/]: and  [CWE-500|http://cwe.mitre.org/data/definitions/500.html] "Public Static Field Not Marked Final"
\[[SCG 2007|AA. Bibliography#SCG 07]\] Guideline 3.1, Treat public static fields as constants

...