rspec/rules/S1444/flex/rule.adoc
Egon Okerman d1417e82f8
Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) (#3529)
* Fix all CWE references

* Fix all OWASP references

* Fix missing CWE prefixes
2024-01-15 17:15:56 +01:00

46 lines
951 B
Plaintext

== Why is this an issue?
There is no good reason to declare a field "public" and "static" without also declaring it "const". Most of the time this is a kludge to share a state among several objects. But with this approach, any object can do whatever it wants with the shared state, such as setting it to ``++null++``.
=== Noncompliant code example
[source,flex]
----
public class Greeter {
public static var foo:Foo = new Foo(...);
...
}
----
=== Compliant solution
[source,flex]
----
public class Greeter {
public static const FOO:Foo = new Foo(...);
...
}
----
== Resources
* CWE - https://cwe.mitre.org/data/definitions/500[CWE-500 - Public Static Field Not Marked Final]
ifdef::env-github,rspecator-view[]
'''
== Implementation Specification
(visible only on this page)
include::../message.adoc[]
'''
== Comments And Links
(visible only on this page)
include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]