1315
Demonstrative Examples
Example 1:
The following Java Applet code mistakenly declares an array public, final and static.
Example Language: Java (Bad)
public final class urlTool extends Applet {
public final static URL[] urls;
...
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 849 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 6 - Object Orientation (OBJ)
844 2364
MemberOf 1002 SFP Secondary Cluster: Unexpected Entry Points 888 2421
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
OBJ10-J Do not use public static nonfinal
variables
Software Fault Patterns SFP28 Unexpected Access Points
CWE-583: finalize() Method Declared Public
Weakness ID : 583
Structure : Simple
Abstraction : Variant
Description
The product violates secure coding principles for mobile code by declaring a finalize() method
public.
Extended Description
A product should never call finalize explicitly, except to call super.finalize() inside an
implementation of finalize(). In mobile code situations, the otherwise error prone practice of manual
garbage collection can become a security threat if an attacker can maliciously invoke a finalize()
method because it is declared with public access.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
CWE Version 4.14
CWE-583: finalize() Method Declared Public
CWE-583: finalize() Method Declared Public