Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Callers can trivially access and modify public non-final static fields. Neither accesses nor modifications can be checked by a SecurityManager, and newly set values cannot be validated. Furthermore, multiple threads can modify non-final public static data in ways that are not consistent.

Wiki Markup
Improper use of public static fields can also lead to type safety issues. For example, untrusted code might supply an unexpected subtype when the variable is defined to be of a more general type such as {{java.lang.Object}}. \[[Gong 03|AA. Java References#Gong 03]\]

Noncompliant Code Example

...

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

OBJ31-J

high

likely

low

P9

L2

References

Avoiding Antipatterns Antipattern 5, Misusing Public Static Variables

Wiki Markup
\[[FT 08|AA. Java References#FT 08]\] 
\[[Nisewanger 07|AA. Java References#Nisewanger 07]\] Antipattern 5, Misusing Public Static Variables
\[[SCG 07|AA. Java References#SCG 07]\] Guideline 
Java Secure Coding Guidelines Section
3.1, Treat public static fields as
constants Anchorref3ref3Function Table Field detail, public static FuncLoader m_functions
 constants
\[[Gong 03|AA. Java References#Gong 03]\] 9.3 Static Fields

...

OBJ03-J. Be careful about final reference      06. Objects Orientation (OBJ)      OBJ32-J. Do not allow partially initialized objects to be accessed