39 /**
40 * Stores the version, loaded from 'project.properties.'
41 */
42 public static String version; 43 /**
44 * The main logger.
45 */ 47 /**
48 * The program's icon.
49 */
50 public static Image icon; 51 /**
52 * The user agent used for requests.
53 * This is set here since it includes the version. 43 /**
44 * The main logger.
45 */
46 public static Logger logger; 47 /**
48 * The program's icon.
49 */ 52 * The user agent used for requests.
53 * This is set here since it includes the version.
54 */
55 public static String userAgent; 56
57 /**
58 * The entry point for the program.26 /**
27 * Stores what OS we are running. Can be win32/win64 or linux.
28 */
29 public static String osType = null;30
31 static {
32 if (SystemUtils.IS_OS_WINDOWS) {This code contains a public static field which is not final, or is mutable even when declared as final.
Consider making the field private, as it is possible that such a field could be manipulated to produce unintended results.
Bad Practice
Here, the NUM_RETRIES field could be manipulated to perform a Denial of Service (DoS) attack when set to some very high number.
class SomeClass {
public static int NUM_RETRIES = 3;
}
// Elsewhere...
SomeClass someObj = ...;
SomeClass.NUM_RETRIES = Integer.MAX_VALUE; // This could make an application hang!
Recommended
There are multiple ways to avoid this, and you must choose the best method as per your requirements.
Make the field final
If you do not need the field to be mutable, consider just making it final:
public static final int NUM_RETRIES = 3;
Make the field private
If you require the field to be mutable, consider making the field private. If you also need to expose the field to API consumers, consider adding a static or instance getter method for the field:
private static int NUM_RETRIES = 3;
// Static getter
public static final int getNumRetries() {
return NUM_RETRIES;
}
// Instance getter, only usable when we have an instance of this class created.
public final int getNumRetries() {
return NUM_RETRIES;
}
If you also need to be able to set the value, make sure to sanitize the assigned data. You could check if the retry value is within a maximum permissible limit (MAX_NUM_RETRIES) and if the assigned value is below 0 or above the maximum limit, clamp that value to within those limits.
public static final void setNumRetries(int retries) {
// clamp retries to within the range 0 to MAX_NUM_RETRIES.
retries = (retries > MAX_NUM_RETRIES) ? MAX_NUM_RETRIES : ((retries < 0) ? 0 : retries);
NUM_RETRIES = retries;
}