1314
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
MET09-J Classes that define an equals() method
must also define a hashCode() method
CWE-582: Array Declared Public, Final, and Static
Weakness ID : 582
Structure : Simple
Abstraction : Variant
Description
The product declares an array public, final, and static, which is not sufficient to prevent the array's
contents from being modified.
Extended Description
Because arrays are mutable objects, the final constraint requires that the array object itself be
assigned only once, but makes no guarantees about the values of the array elements. Since the
array is public, a malicious program can change the values stored in the array. As such, in most
cases an array declared public, final and static is a bug.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Background Details
Mobile code, in this case a Java Applet, is code that is transmitted across a network and executed
on a remote machine. Because mobile code developers have little if any control of the environment
in which their code will execute, special security concerns become relevant. One of the biggest
environmental threats results from the risk that the mobile code will run side-by-side with other,
potentially malicious, mobile code. Because all of the popular web browsers execute code from
multiple sources together in the same JVM, many of the security guidelines for mobile code are
focused on preventing manipulation of your objects' state and behavior by adversaries who have
access to the same virtual machine where your product is running.
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
Potential Mitigations
Phase: Implementation
In most situations the array should be made private.
CWE Version 4.14
CWE-583: finalize() Method Declared Public
CWE-583: finalize() Method Declared Public