|
|
Status: Draft Weakness ID: 582 (Weakness Variant)Description Summary The program declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified. Extended Description Because arrays are mutable objects, the final constraint requires that the array object itself be assigned only once, but makes no guarantees about the values of the array elements. Since the array is public, a malicious program can change the values stored in the array. As such, in most cases an array declared public, final and static is a bug. Weakness Ordinalities Primary (where the weakness exists independent of other weaknesses) Potential Mitigations In most situations the array should be made private. Demonstrative Examples The following Java Applet code mistakenly declares an array public, final and static. public final class urlTool extends Applet { public final static URL[] urls; ... }
Background Details Mobile code, in this case a Java Applet, is code that is transmitted across a network and executed on a remote machine. Because mobile code developers have little if any control of the environment in which their code will execute, special security concerns become relevant. One of the biggest environmental threats results from the risk that the mobile code will run side-by-side with other, potentially malicious, mobile code. Because all of the popular web browsers execute code from multiple sources together in the same JVM, many of the security guidelines for mobile code are focused on preventing manipulation of your objects' state and behavior by adversaries who have access to the same virtual machine where your program is running. Relationships
Applicable Platforms Languages Java Time of Introduction  ImplementationContent History Modifications Eric Dalci. Cigital. 2008-07-01. (External) updated Time_of_Introduction CWE Content Team. MITRE. 2008-09-08. (Internal) updated Description, Relationships, Other_Notes, Weakness_Ordinalities CWE Content Team. MITRE. 2008-10-14. (Internal) updated Background_Details, Demonstrative_Examples, Description, Other_Notes Previous Entry Names Mobile Code: Unsafe Array Declaration (changed 2008-04-11) |
|
|
|||
