Under Construction

Sensitive fields declared as public and static can be modified by untrusted codeCallers can trivially access and modify public non-final static fields. Neither accesses nor modifications can be checked by a SecurityManager, and newly set values can not be validated. Furthermore multiple threads can modify non-final public static data in ways that are not consistent.

Noncompliant code example

This is an example from the JDK 1.4.2 software.

package org.apache.xpath.compiler; 

public class FunctionTable {

    public static FuncLoader m_functions;

}

An attacker can replace the function table as follows

FunctionTable.m_functions = <new_table>;

Replacing the function table gives the attacker access to the XPathContext used to evaluate XPath expression. Static variables are global across a Java runtime environment. They can be used as a communication channel between different application domains (e.g. by code loaded into different class loaders) .

Compliant Solution

There are severals way several strategies one can adopt to tackle this problem.

1. Treat public static fields as constants and declare them as final. Consider the use of enum types.

public class MyClass {
    public static final int LEFT = 1;
    public static final int RIGHT = 2;
}

2. Reduce the scope of static fields. This ensures access only by legitimate public member functions which can then use SecurityManager to validate access to the static field.

package org.apache.xpath.compiler; 

public class FunctionTable {

    private static FuncLoader m_functions;

}

Make public static fields final3. Define assessor methods for mutable static state. Add appropriate security checks.

public class MyClass {

    private static byte[] data;
    public static byte[] getData() {
        return data.clone();
    }

    public static void setData(byte[] b) {
        securityCheck();
       data = b.clone();
    }
}

Risk Assessment

References
Avoiding Antipatterns Antipattern 5, Misusing Public Static Variables

Java Secure Coding Guidelines Section 3.1, Treat public static fields as constants

Function Table Field detail, public static FuncLoader m_functions

...