...
| Wiki Markup |
|---|
Improper use of {{public static}} fields can also result in type safety issues. For example, untrusted code can supply an unexpected subtype when the variable is defined to be of a more general type, such as {{java.lang.Object}} \[[Gong 2003|AA. Bibliography#Gong 03]\]. |
Noncompliant Code Example
| Wiki Markup |
|---|
This noncompliant code example is adopted from JDK v1.4.2 \[[FT 2008|AA. Bibliography#FT 08]\]. It declares a function table containing a {{public static}} field. |
...
Note that this vulnerability was repaired in JDK v1.4.2_05.
Compliant Solution
This compliant solution declares the FuncLoader static field final and treats it like a constant.
...
It is also permissible to use a wrapper method to retrieve the value of m_functions. This has encapsulation advantages because it permits m_functions to be declared private. See rule "OBJ01-J. Declare data members as private and provide accessible wrapper methods" for more information.
Noncompliant Code Example (serialVersionUID)
This noncompliant code example uses a public static non-final serialVersionUID field in a class designed for serialization.
| Code Block | ||
|---|---|---|
| ||
class DataSerializer implements Serializable {
public static long serialVersionUID = 1973473122623778747L;
// ...
}
|
Compliant Solution
This compliant solution declares the serialVersionUID field final and limits its accessibility to private.
...
The serialization mechanism uses the serialVersionUID field internally, so accessible wrapper methods are unnecessary.
Risk Assessment
Unauthorized modifications of public static variables can result in unexpected behavior and violation of class invariants. Furthermore, because static variables can be visible to code loaded by different class loaders when those class loaders are in the same delegation chain, such variables can be used as a covert communication channel between different application domains in some cases.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
OBJ04-J | medium | probable | medium | P8 | L2 |
Related Guidelines
CWE-582 "Array Declared Public, Final, and Static," | ||||
| CWE-493 "Critical Public Variable Without Final Modifier" | |||
| CWE-500 "Public Static Field Not Marked Final" | |||
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="bd809521f2412143-45b28b33-4ce04cbc-9a6ba4b4-a331425afdfa0337cfcf38ea"><ac:plain-text-body><![CDATA[ | [[SCG 2007 | AA. Bibliography#SCG 07]] | Guideline 3.1, Treat public static fields as constants | ]]></ac:plain-text-body></ac:structured-macro> |
Bibliography
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a064632d55cfeab7-4639a893-441041cc-8aa78a67-feadc53b095a41a6d33339e8"><ac:plain-text-body><![CDATA[ | [[FT 2008 | AA. Bibliography#FT 08]] | Function Table Class Function Table | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="56e04c88f60b5789-a676b6d6-4f9d41ea-8d4b9a3e-8c514054287c81ab36781ef6"><ac:plain-text-body><![CDATA[ | [[Gong 2003 | AA. Bibliography#Gong 03]] | 9.3 Static Fields | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a40e33dc3d8ebff6-767cbe91-4d46427d-a60cb488-e79fec92e6d976543f2c93a2"><ac:plain-text-body><![CDATA[ | [[Nisewanger 2007 | AA. Bibliography#Nisewanger 07]] | Antipattern 5, Misusing Public Static Variables | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5c628abffeea6881-54907d32-45bf4b23-b147b1f8-47dbc7fbd59fc98d8c9a4663"><ac:plain-text-body><![CDATA[ | [[Sterbenz 2006 | AA. Bibliography#Sterbenz 06]] | Antipattern 5, Misusing Public Static Variables | ]]></ac:plain-text-body></ac:structured-macro> |
...