1487
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1006 Bad Coding Practices 2422
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Other
Unexpected State
Quality Degradation
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Phase: Testing
Do not make explicit calls to finalize(). Use static analysis tools to spot such instances.
Demonstrative Examples
Example 1:
The following code fragment calls finalize() explicitly:
Example Language: Java (Bad)
// time to clean up
widget.finalize();
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 850 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 7 - Methods (MET)
844 2364
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1140 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 06. Methods (MET)
1133 2447
CWE Version 4.14
CWE-587: Assignment of a Fixed Address to a Pointer
CWE-587: Assignment of a Fixed Address to a Pointer