6f24cc0632
In some cases, the `rule.adoc` at root of a rule is never included anywhere and thus is dead code. It's a maintenance cost by itself, but also it misses opportunities to inline code that seems used by two documents when in fact only one document is actually rendered. And this missed opportunity, in turn, stops us from applying the correct language tag on the code samples.
58 lines
2.0 KiB
Plaintext
58 lines
2.0 KiB
Plaintext
== Why is this an issue?
|
|
|
|
There is no good reason to have a mutable object as the ``++public++`` (by default), ``++static++`` member of an ``++interface++``. Such variables should be moved into classes and their visibility lowered.
|
|
|
|
|
|
Similarly, mutable ``++static++`` members of classes and enumerations which are accessed directly, rather than through getters and setters, should be protected to the degree possible. That can be done by reducing visibility or making the field ``++final++`` if appropriate.
|
|
|
|
|
|
Note that making a mutable field, such as an array, ``++final++`` will keep the variable from being reassigned, but doing so has no effect on the mutability of the internal state of the array (i.e. it doesn't accomplish the goal).
|
|
|
|
|
|
This rule raises issues for ``++public static++`` array, ``++Collection++``, ``++Date++``, and ``++awt.Point++`` members.
|
|
|
|
|
|
=== Noncompliant code example
|
|
|
|
[source,java]
|
|
----
|
|
public interface MyInterface {
|
|
public static String [] strings; // Noncompliant
|
|
}
|
|
|
|
public class A {
|
|
public static String [] strings1 = {"first","second"}; // Noncompliant
|
|
public static String [] strings2 = {"first","second"}; // Noncompliant
|
|
public static List<String> strings3 = new ArrayList<>(); // Noncompliant
|
|
// ...
|
|
}
|
|
----
|
|
|
|
|
|
== Resources
|
|
|
|
* https://cwe.mitre.org/data/definitions/582[MITRE, CWE-582] - Array Declared Public, Final, and Static
|
|
* https://cwe.mitre.org/data/definitions/607[MITRE, CWE-607] - Public Static Final Field References Mutable Object
|
|
* https://wiki.sei.cmu.edu/confluence/x/LjdGBQ[CERT, OBJ01-J.] - Limit accessibility of fields
|
|
* https://wiki.sei.cmu.edu/confluence/x/VzZGBQ[CERT, OBJ13-J.] - Ensure that references to mutable objects are not exposed
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
* Move "xxx" to a class and lower its visibility.
|
|
* Make this member "protected".
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|