1202
Example Language: C++ (Bad)
class SomeAppClass {
public:
static string appPropertiesConfigFile = "app/properties.config";
...
}
Example Language: Java (Bad)
public class SomeAppClass {
public static String appPropertiesFile = "app/Application.properties";
...
}
Having a public static variable that is not marked final (constant) may allow the variable to the
altered in a way not intended by the application. In this example the String variable can be modified
to indicate a different on nonexistent properties file which could cause the application to crash or
caused unexpected behavior.
Example Language: C++ (Good)
class SomeAppClass {
public:
static const string appPropertiesConfigFile = "app/properties.config";
...
}
Example Language: Java (Good)
public class SomeAppClass {
public static final String appPropertiesFile = "app/Application.properties";
...
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 849 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 6 - Object Orientation (OBJ)
844 2364
MemberOf 1002 SFP Secondary Cluster: Unexpected Entry Points 888 2421
MemberOf 1139 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 05. Object Orientation (OBJ)
1133 2446
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Overflow of static internal buffer
The CERT Oracle Secure
Coding Standard for Java
(2011)
OBJ10-J Do not use public static nonfinal
variables
Software Fault Patterns SFP28 Unexpected access points
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE Version 4.14
CWE-501: Trust Boundary Violation
CWE-501: Trust Boundary Violation