Public Static Field Not Marked Final

Description

Public static variables can be read without an accessor and changed without a mutator by any classes in the application.

Background

When a field is declared public but not final, the field can be read and written to by arbitrary Java code.

Demonstrations

The following examples help to illustrate the nature of this weakness and describe methods or techniques which can be used to mitigate the risk.

Note that the examples here are by no means exhaustive and any given weakness may have many subtle varieties, each of which may require different detection methods or runtime controls.

Example One

The following examples use of a public static String variable to contain the name of a property/configuration file for the application.

class SomeAppClass {


  public:
    static string appPropertiesConfigFile = "app/properties.config";

  ...

}

public class SomeAppClass {


  public static String appPropertiesFile = "app/Application.properties";
  ...

}

Having a public static variable that is not marked final (constant) may allow the variable to the altered in a way not intended by the application. In this example the String variable can be modified to indicate a different on nonexistent properties file which could cause the application to crash or caused unexpected behavior.

class SomeAppClass {


  public:
    static const string appPropertiesConfigFile = "app/properties.config";

  ...

}

public class SomeAppClass {


  public static final String appPropertiesFile = "app/Application.properties";
  ...

}

See Also