Why are public static final array a security hole?

java effective-java
unj2 picture unj2 · May 16, 2010 · Viewed 20.8k times · Source

Effective java says:

// Potential security hole!

static public final Thing[] VALUES = { ... };

Can somebody tell me what is the security hole?

Answer

mdma picture mdma · May 16, 2010

Declaring static final public fields is usually the hallmark of a class constant. It's perfectly fine for primitive types (ints, doubles etc..), and immutable classes, like strings and java.awt.Color. With arrays, the problem is that even though the array reference is constant, the elements of the array can still be changed, and as it's a field, changes are unguarded, uncontrolled, and usually unwelcome.

To combat this, the visibility of the array field can be restricted to private or package private, so you have a smaller body of code to consider when looking for suspicious modification. Alternatively, and often better, is to do away with the array together and use a 'List', or other appropriate collection type. By using a collection, you control if updates are allowed, since all updates go through methods. You can prevent updates by wrapping your collection using Collections.unmodifiableList(). But beware that even though the collection is immutable, you must also be sure that the types stored in it are also immutable, or the risk of unsolicited changes on a supposed constant will reappear.

Related questions

What is an AssertionError? In which case should I throw it from my own code?

In Item 2 of the "Effective Java, 2nd edition" book, there is this snippet of code, in which the author wants to forbid the empty initialization of an object. class Example { private Example() { throw new AssertionError(); } } The type of exception thrown, …

Read More
Java Model Objects design

So I've been reading some Effective Java! And one of the most inspiring sections of the book is the Immutable Object/Builder section where Bloch writes about the "Builder" - class instead of just POJOs. NOTE: I am talking about …

Read More
Why are readObject and writeObject private, and why would I write transient variables explicitly?

I am reading the chapter on Serialization in Effective Java. Who calls the readObject() and writeObject()? Why are these methods declared private ? The below is a piece of code from the book // StringList with a reasonable custom serialized form public …

Read More