ABSTRACT

The program violates secure coding principles for mobile code by declaring an array public, final and static.

EXPLANATION

In most cases an array declared public, final and static is a bug. Because arrays are mutable objects, the final constraint requires that the array object itself be assigned only once, but makes no guarantees about the values of the array elements. Since the array is public, a malicious program can change the values stored in the array. In most situations the array should be made private.

Example 1: The following Java Applet code mistakenly declares an array public, final and static.


public final class urlTool extends Applet {
public final static URL[] urls;
...
}


Mobile code, in this case a Java Applet, is code that is transmitted across a network and executed on a remote machine. Because mobile code developers have little if any control of the environment in which their code will execute, special security concerns become relevant. One of the biggest environmental threats results from the risk that the mobile code will run side-by-side with other, potentially malicious, mobile code. Because all of the popular web browsers execute code from multiple sources together in the same JVM, many of the security guidelines for mobile code are focused on preventing manipulation of your objects' state and behavior by adversaries who have access to the same virtual machine where your program is running.

REFERENCES

[1] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 582

[2] G. McGraw Securing Java. Chapter 7: Java Security Guidelines