CWE-582 公开、最终、静态声明的数组

Array Declared Public, Final, and Static

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

The program declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified.

扩展描述

Because arrays are mutable objects, the final constraint requires that the array object itself be assigned only once, but makes no guarantees about the values of the array elements. Since the array is public, a malicious program can change the values stored in the array. As such, in most cases an array declared public, final and static is a bug.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 668 cwe_View_ID: 1000 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Name': 'Java', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
Integrity	Modify Application Data

可能的缓解方案

Implementation

策略:

In most situations the array should be made private.

示例代码

例

The following Java Applet code mistakenly declares an array public, final and static.

bad Java

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
The CERT Oracle Secure Coding Standard for Java (2011)	OBJ10-J		Do not use public static nonfinal variables