CWE-500 公开静态字段没有标记为Final
Public Static Field Not Marked Final
结构: Simple
Abstraction: Variant
状态: Draft
被利用可能性: High
基本描述
An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
扩展描述
Public static variables can be read without an accessor and changed without a mutator by any classes in the application.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 493 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 493 cwe_View_ID: 699 cwe_Ordinal: Primary
适用平台
Language: [{'cwe_Name': 'C++', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'Java', 'cwe_Prevalence': 'Undetermined'}]
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Integrity | Modify Application Data | The object could potentially be tampered with. |
| Confidentiality | Read Application Data | The object could potentially allow the object to be read. |
可能的缓解方案
Architecture and Design
策略:
Clearly identify the scope for all critical data elements, including whether they should be regarded as static.
Implementation
策略:
Make any static fields private and constant.
A constant field is denoted by the keyword 'const' in C/C++ and ' final' in Java
示例代码
例
The following examples use of a public static String variable to contain the name of a property/configuration file for the application.
bad C++
public:
...
}
bad Java
public static String appPropertiesFile = "app/Application.properties";
...
}
Having a public static variable that is not marked final (constant) may allow the variable to the altered in a way not intended by the application. In this example the String variable can be modified to indicate a different on nonexistent properties file which could cause the application to crash or caused unexpected behavior.
good C++
public:
...
}
good Java
public static final String appPropertiesFile = "app/Application.properties";
...
}
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| CLASP | Overflow of static internal buffer | ||
| The CERT Oracle Secure Coding Standard for Java (2011) | OBJ10-J | Do not use public static nonfinal variables | |
| Software Fault Patterns | SFP28 | Unexpected access points |
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论