Page History

Client code can trivially access public static fields . Neither reads nor writes as access to such variables fields are not checked by a security manager. Furthermore, new values cannot be validated programmatically before they are stored in these fields.

...

Improper use of public static fields can also result in type-safety issues. For example, untrusted code can supply an unexpected subtype with malicious methods when the variable is defined to be of a more general type, such as java.lang.Object [Gong 2003]. As a result, classes must not contain nonfinal public static fields.

Noncompliant Code Example

This noncompliant code example is adopted from JDK v1.4.2 [FT 2008]. It declares a function table containing a public static field.

...

This vulnerability was repaired in JDK v1.4.2_05.

Compliant Solution

This compliant solution declares the FuncLoader static field final and treats it as a constant.

...

It is also permissible to use a wrapper method to retrieve the value of m_functions, allowing m_functions to be declared private. See rule OBJ01-J. Declare data members as private and provide accessible wrapper methods for more information.

Noncompliant Code Example (serialVersionUID)

This noncompliant code example uses a public static nonfinal serialVersionUID field in a class designed for serialization.

class DataSerializer implements Serializable {
  public static long serialVersionUID = 1973473122623778747L;
  // ...
}

Compliant Solution

This compliant solution declares the serialVersionUID field final and private.

...

The serialization mechanism uses the serialVersionUID field internally, so accessible wrapper methods are unnecessary.

Risk Assessment

Unauthorized modifications of public static variables can result in unexpected behavior and violation of class invariants. Furthermore, because static variables can be visible to code loaded by different class loaders when those class loaders are in the same delegation chain, such variables can be used as a covert communication channel between different application domains.

Automated Detection

Related Guidelines

Bibliography

...