CWE-607: Public Static Final Field References Mutable Object
Public Static Final Field References Mutable Object
Weakness ID: 607 (Weakness Variant)
Status: Draft
Description
Description Summary
A public or protected static final field references a mutable
object, which allows the object to be changed by malicious code, or accidentally
from another package
Time of Introduction
Implementation
Applicable Platforms
Languages
Java
Demonstrative Examples
Example 1
Here, an array (which is inherently mutable) is labeled public
static final.
(Bad Code)
Java
public static final String[] USER_ROLES;
Potential Mitigations
Phase
Description
Protect mutable objects by making them private. Restrict access to the
getter and setter as well.
Description
