CWE-500ΒΆ

Public Static Field Not Marked Final. [Improper-Control-Of-A-Resource-Through-Its-Lifetime]

Required inputs: IR

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways. Public static variables can be read without an accessor and changed without a mutator by any classes in the application.
Background Details Demonstrative Examples
When a field is declared public but not final, the field can be read and written to by arbitrary Java code.
Background Details Demonstrative Examples
Example 1

The following examples use of a public static String variable to contain the name of a property/configuration file for the application.

Example Language:C++
    class SomeAppClass {
        public:
            static string appPropertiesConfigFile = "app/properties.config";

        ...
    }
Example Language:Java (Unsupported language for documentation only)
    public class SomeAppClass {
        public static String appPropertiesFile = "app/Application.properties";
        ...
    }

Having a public static variable that is not marked final (constant) may allow the variable to the altered in a way not intended by the application. In this example the String variable can be modified to indicate a different on nonexistent properties file which could cause the application to crash or caused unexpected behavior.

Example Language:C++
    class SomeAppClass {
        public:
            static const string appPropertiesConfigFile = "app/properties.config";

        ...
    }
Example Language:Java (Unsupported language for documentation only)
    public class SomeAppClass {
        public static final String appPropertiesFile = "app/Application.properties";
        ...
    }
Excerpts from CWE [https://cwe.mitre.org], Copyright (C) 2006-2026, the MITRE Corporation. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key

Text

Severity

Disabled

public_static_without_const

Public static fields must be const.

None

False

Options