...
| Code Block |
|---|
FunctionTable.m_functions = <new_table><new_table>; |
Replacing the function table gives the attacker access to the XPathContext. The XPathContext is used to set the reference node for evaluating XPath expressions. Manipulating it can allow XML fields to be modified in inconsistent ways, resulting in unexpected behavior. Also, because static variables are global across the Java Runtime Environment (JRE), they can be used as a covert communication channel between different application domains (e.g., through code loaded by different class loaders).
...
| Wiki Markup |
|---|
\[[FT 08|AA. Java References#FT 08]\] \[[Sterbenz 06|AA. Java References#Sterbenz 06]\] Antipattern 5, Misusing Public Static Variables \[[Nisewanger 07|AA. Java References#Nisewanger 07]\] Antipattern 5, Misusing Public Static Variables \[[SCG 07|AA. Java References#SCG 07]\] Guideline 3.1, Treat public static fields as constants \[[Gong 03|AA. Java References#Gong 03]\] 9.3 Static Fields \[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 582|http://cwe.mitre.org/data/definitions/582.html] ""Array Declared Public, Final, and Static"", [CWE ID 493|http://cwe.mitre.org/data/definitions/493.html] ""Critical Public Variable Without Final Modifier"", [CWE ID 500|http://cwe.mitre.org/data/definitions/500.html] ""Public Static Field Not Marked Final"" |
...
OBJ30-J. Do not ignore return values of methods that operate on immutable objects 08. Object Orientation (OBJ) OBJ32-J. Do not allow partially initialized objects to be accessed