|
|
|
|
CWE-500: Public Static Field Not Marked Final| | Public Static Field Not Marked Final |
|
| Weakness ID: 500 (Weakness Variant) | | Status: Draft |
 Description
Description Summary An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
Time of Introduction Common Consequences | Scope | Effect |
|---|
Integrity | Technical Impact: Modify application
data The object could potentially be tampered with. |
Confidentiality | Technical Impact: Read application
data The object could potentially allow the object to be read. |
Likelihood of Exploit Demonstrative Examples Example 1 This is a static variable that can be read without an accessor and
changed without a mutator. (Bad Code) Example
Language: C++ public:
static string str = "My String";
(Bad Code) Example
Language: Java static public String str = "My String"; Potential Mitigations
Phase: Architecture and Design Clearly identify the scope for all critical data elements, including
whether they should be regarded as static. |
Phase: Implementation Make any static fields private and final. |
Background Details
When a field is declared public but not final, the field can be read and
written to by arbitrary Java code. |
Relationships Taxonomy Mappings | Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|
| CLASP | | | Overflow of static internal buffer |
| CERT Java Secure Coding | OBJ04-J | | Do not use public static non-final
variables |
White Box Definitions
|
A weakness where code path has a statement that defines a public field
that is static and non-final
|
Content History | Submissions |
|---|
| Submission Date | Submitter | Organization | Source |
|---|
| CLASP | | Externally Mined | | | Modifications |
|---|
| Modification Date | Modifier | Organization | Source |
|---|
| 2008-07-01 | Eric Dalci | Cigital | External | | updated Time_of_Introduction | | 2008-08-01 | | KDM Analytics | External | | added/updated white box definitions | | 2008-09-08 | CWE Content Team | MITRE | Internal | | updated Applicable_Platforms, Common_Consequences,
Relationships, Other_Notes, Taxonomy_Mappings | | 2008-11-05 | CWE Content Team | MITRE | Internal | | Significant clarification of this entry, and improved
examples. | | 2008-11-24 | CWE Content Team | MITRE | Internal | | updated Background_Details, Demonstrative_Examples,
Description, Name, Other_Notes, Potential_Mitigations | | 2009-05-27 | CWE Content Team | MITRE | Internal | | updated Relationships | | 2011-06-01 | CWE Content Team | MITRE | Internal | | updated Common_Consequences, Relationships,
Taxonomy_Mappings | | Previous Entry Names |
|---|
| Change Date | Previous Entry
Name |
|---|
| 2008-04-11 | Overflow of Static Internal
Buffer | | | 2008-11-24 | Static Field Not Marked
Final | |
|
