CWE-607: Public Static Final Field References Mutable Object
Public Static Final Field References Mutable Object
Weakness ID: 607 (Weakness Variant)
Status: Draft
Description
Description Summary
A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.
Time of Introduction
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Integrity
Technical Impact: Modify application
data
Demonstrative Examples
Example 1
Here, an array (which is inherently mutable) is labeled public
static final.
(Bad Code)
Example
Language: Java
public static final String[] USER_ROLES;
Potential Mitigations
Protect mutable objects by making them private. Restrict access to the
getter and setter as well.
Description
