Page History

Methods that can both can modify a static field and also can be invoked from untrusted code must synchronize access to the static field. Even when client-side locking is a specified requirement of the method, untrusted clients can fail to synchronize (whether inadvertently or maliciously). Because the static field is shared by all clients, untrusted clients may violate the contract by failing to provide suitable locking.

...

This class definition complies with rule VNA02-J. Ensure that compound operations on shared variables are atomic, which applies only applies to classes that promise thread-safety. However, this class has a mutable static counter field that is modified by the publicly accessible incrementCounter() method. Consequently, this class cannot be used securely by trusted client code , because untrusted code can purposely fail to externally synchronize access to the field.

...

This compliant solution uses a static private final lock to protect the counter field and , consequently , lacks any dependence on external synchronization. This solution also complies with rule LCK00-J. Use private final lock objects to synchronize classes that may interact with untrusted code.

...

Failure to internally synchronize access to static fields that can be modified by untrusted code risks incorrect synchronization , because the author of the untrusted code can ignore the synchronization policy (whether inadvertently or maliciously).

...

Related Guidelines

Bibliography

...