|
|
|
|
CWE-500: Public Static Field Not Marked Final | |
| | Public Static Field Not Marked Final |
|
| Weakness ID: 500 (Weakness Variant) | | Status: Draft |
 Description
Description Summary An object contains a public static field that is not marked
final, which might allow it to be modified in unexpected
ways.
Time of Introduction Common Consequences | Scope | Effect |
|---|
Integrity | The object could potentially be tampered with. |
Confidentiality | The object could potentially allow the object to be read. |
Likelihood of Exploit Demonstrative Examples Example 1 This is a static variable that can be read without an accessor and
changed without a mutator. (Bad Code) C++ public:
static string str = "My String";
(Bad Code) Java static public String str = "My String"; Potential Mitigations | Phase | Description |
|---|
Architecture and Design | Clearly identify the scope for all critical data elements, including
whether they should be regarded as static. |
Implementation | Make any static fields private and final. |
Background Details
|
When a field is declared public but not final, the field can be read and
written to by arbitrary Java code.
|
Relationships Taxonomy Mappings | Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|
| CLASP | | | Overflow of static internal buffer |
White Box Definitions
|
A weakness where code path has a statement that defines a public field
that is static and non-final
|
Content History | Submissions |
|---|
| Submission Date | Submitter | Organization | Source |
|---|
| CLASP | | Externally Mined | | | Modifications |
|---|
| Modification Date | Modifier | Organization | Source |
|---|
| 2008-07-01 | Eric Dalci | Cigital | External | | updated Time of Introduction | | 2008-08-01 | | KDM Analytics | External | | added/updated white box definitions | | 2008-09-08 | CWE Content Team | MITRE | Internal | | updated Applicable Platforms, Common Consequences,
Relationships, Other Notes, Taxonomy Mappings | | 2008-11-05 | CWE Content Team | MITRE | Internal | | Significant clarification of this entry, and improved
examples. | | 2008-11-24 | CWE Content Team | MITRE | Internal | | updated Background Details, Demonstrative Examples,
Description, Name, Other Notes, Potential Mitigations | | 2009-05-27 | CWE Content Team | MITRE | Internal | | updated Relationships |
|
