1291
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Quality Degradation
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Call the super.finalize() method.
Phase: Testing
Use static analysis tools to spot such issues in your code.
Demonstrative Examples
Example 1:
The following method omits the call to super.finalize().
Example Language: Java (Bad)
protected void finalize() {
discardNative();
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 850 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 7 - Methods (MET)
844 2364
MemberOf 1002 SFP Secondary Cluster: Unexpected Entry Points 888 2421
MemberOf 1140 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 06. Methods (MET)
1133 2447
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
MET12-J Do not use finalizers
Software Fault Patterns SFP28 Unexpected access points
CWE Version 4.14
CWE-570: Expression is Always False
CWE-570: Expression is Always False