CWE-582 公开、最终、静态声明的数组

Array Declared Public, Final, and Static

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

The program declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified.

扩展描述

Because arrays are mutable objects, the final constraint requires that the array object itself be assigned only once, but makes no guarantees about the values of the array elements. Since the array is public, a malicious program can change the values stored in the array. As such, in most cases an array declared public, final and static is a bug.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 668 cwe_View_ID: 1000 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Name': 'Java', 'cwe_Prevalence': 'Undetermined'}

常见的影响

可能的缓解方案

Implementation

策略:

In most situations the array should be made private.

示例代码

例

The following Java Applet code mistakenly declares an array public, final and static.

bad Java

分类映射

文章来源于互联网:scap中文网