VariantIncomplete
CWE-583finalize() Method Declared Public
Category: other
Description
The product violates secure coding principles for mobile code by declaring a finalize() method public.
A product should never call finalize explicitly, except to call super.finalize() inside an implementation of finalize(). In mobile code situations, the otherwise error prone practice of manual garbage collection can become a security threat if an attacker can maliciously invoke a finalize() method because it is declared with public access.
Common consequences· 1
- Confidentiality / Integrity / Availability — Alter Execution Logic, Execute Unauthorized Code or Commands, Modify Application Data
Potential mitigations· 1
- [Implementation]If you are using finalize() as it was designed, there is no reason to declare finalize() with anything other than protected access.
References
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.