Public Static Field Not Marked Final

Opis

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

Public static variables can be read without an accessor and changed without a mutator by any classes in the application.

Skutki

• Integrity

  Modify Application Data

  The object could potentially be tampered with.

• Confidentiality

  Read Application Data

  The object could potentially allow the object to be read.

Zapobieganie

• Architecture and Design

  Clearly identify the scope for all critical data elements, including whether they should be regarded as static.

• Implementation

  Make any static fields private and constant.

  A constant field is denoted by the keyword 'const' in C/C++ and ' final' in Java

Słabość nadrzędna

• CWE-493 Critical Public Variable Without Final Modifier

Kiedy powstaje

• Implementation

Dotyczy

C++, Java

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005