CWE - CWE-586: Explicit Call to Finalize() (2.11)

Weakness ID: 586

Abstraction: Variant

Status: Draft

Presentation Filter:

Description

Description Summary

The software makes an explicit call to the finalize() method from outside the finalizer.

Extended Description

While the Java Language Specification allows an object's finalize() method to be called from outside the finalizer, doing so is usually a bad idea. For example, calling finalize() explicitly means that finalize() will be called more than once: the first time will be the explicit call and the last time will be the call that is made after the object is garbage collected.

Time of Introduction

Implementation

Applicable Platforms

Languages

Java

Common Consequences

Scope	Effect
Integrity Other	Technical Impact: Unexpected state; Quality degradation

Demonstrative Examples

Example 1

The following code fragment calls finalize() explicitly:

(Bad Code)

Example Language: Java

// time to clean up

widget.finalize();

Potential Mitigations

Phases: Implementation; Testing

Do not make explicit calls to finalize(). Use static analysis tools to spot such instances.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Weakness Class	227	Improper Fulfillment of API Contract ('API Abuse')	Research Concepts (primary)1000
ChildOf	Weakness Class	398	Indicator of Poor Code Quality	Development Concepts (primary)699
ChildOf	Category	850	CERT Java Secure Coding Section 05 - Methods (MET)	Weaknesses Addressed by the CERT Java Secure Coding Standard (primary)844
ChildOf	Category	1001	SFP Secondary Cluster: Use of an Improper API	Software Fault Pattern (SFP) Clusters (primary)888
PeerOf	Weakness Class	675	Duplicate Operations on Resource	Research Concepts1000

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
CERT Java Secure Coding	MET12-J		Do not use finalizers
Software Fault Patterns	SFP3		Use of an improper API

Content History

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Name, Potential_Mitigations, Time_of_Introduction
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Relationships, Other_Notes
2009-05-27	CWE Content Team	MITRE	Internal
2009-05-27	updated Demonstrative_Examples
2009-10-29	CWE Content Team	MITRE	Internal
2009-10-29	updated Description, Other_Notes
2011-06-01	CWE Content Team	MITRE	Internal
2011-06-01	updated Common_Consequences, Relationships, Taxonomy_Mappings
2011-06-27	CWE Content Team	MITRE	Internal
2011-06-27	updated Common_Consequences
2012-05-11	CWE Content Team	MITRE	Internal
2012-05-11	updated Relationships, Taxonomy_Mappings
2012-10-30	CWE Content Team	MITRE	Internal
2012-10-30	updated Potential_Mitigations
2014-07-30	CWE Content Team	MITRE	Internal
2014-07-30	updated Relationships, Taxonomy_Mappings
Previous Entry Names
Change Date	Previous Entry Name
2008-09-09	Explicit Call to Finalize


	Use of the Common Weakness Enumeration and the associated references from this website are subject to the Terms of Use. For more information, please email cwe@mitre.org. CWE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 2006-2017, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.	Privacy policy Terms of use Contact us

Common Weakness Enumeration

CWE-586: Explicit Call to Finalize()