1184
Example Language: Java (Bad)
public final class WidgetData extends Applet {
public float price;
...
public WidgetData(...) {
this.price = LookupPrice("MyWidgetType");
}
}
The price field is not final. Even though the value is set by the constructor, it could be modified by
anybody that has access to an instance of WidgetData.
Example 2:
Assume the following code is intended to provide the location of a configuration file that controls
execution of the application.
Example Language: C++ (Bad)
public string configPath = "/etc/application/config.dat";
Example Language: Java (Bad)
public String configPath = new String("/etc/application/config.dat");
While this field is readable from any function, and thus might allow an information leak of a
pathname, a more serious problem is that it can be changed by any function.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 485 7PK - Encapsulation 700 2328
MemberOf 849 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 6 - Object Orientation (OBJ)
844 2364
MemberOf 1002 SFP Secondary Cluster: Unexpected Entry Points 888 2421
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Mobile Code: Non-Final Public Field
CLASP Failure to provide confidentiality for
stored data
The CERT Oracle Secure
Coding Standard for Java
(2011)
OBJ10-J Do not use public static nonfinal
variables
Software Fault Patterns SFP28 Unexpected access points
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE Version 4.14
CWE-494: Download of Code Without Integrity Check
CWE-494: Download of Code Without Integrity Check