Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This compliant solution declares the FuncLoader static field final and treats it as a constant:

Code Block
bgColor#ccccff
public static final FuncLoader m_functions;
// Initialize m_functions in a static initialization block

Fields declared static and final are also safe for multithreaded use (see TSM03-J. Do not publish partially initialized objects for more information). However, remember that simply changing the modifier to final might not prevent attackers from indirectly retrieving an incorrect value from the static final variable before its initialization (see DCL00-J. Prevent class initialization cycles for more information). Furthermore, individual members of the referenced object can also be changed if the object itself is mutable.

It is also permissible to use a wrapper method to retrieve the value of m_functions, allowing m_functions to be declared private (see rule OBJ01-J. Limit accessibility of fields for more information).

...

ToolVersionCheckerDescription
Eclipse1.0 Implemented. The serializable class .* does not declare a static final serialVersionUID field of type long
Coverity7.5FB.MS_SHOULD_BE_FINALImplemented
Findbugs1.0MS_MUTABLE_ARRAY MS_SHOULD_BE_FINAL Implemented

...

MITRE CWE

CWE-493, Critical Public Variable without Final Modifier
CWE-500, Public Static Field Not Marked Final

Secure Coding Guidelines for the Java Programming LanguageSE, Version 35.0

Guideline 3-1. Treat public static fields as 6-10 / MUTABLE-10: Ensure public static final field values are constants

Bibliography

[FT 2008]

"Function Table"
"Class Function Table"

[Gong 2003]

Section 9.3, "Static Fields"

[Nisewanger 2007]

Antipattern 5, Misusing Public Static Variables

[Sterbenz 2006]

Antipattern 5, Misusing Public Static Variables

...