25 ALWAYS, DROP, KEEP, TRANSFER, CLEAR
26 }
27
28 public static boolean DEBUG = false; 29 private static boolean globalStatus = true;
30 private static int configVersion;
31 private static String minecraftVersion;15public final class InstanceCreator implements BeforeAllCallback, ExtensionContext.Store.CloseableResource {
16
17 private static boolean started = false;
18 public static PluginTest pt;19
20 private InstanceCreator() {
21 }This code contains a public static field which is not final, or is mutable even when declared as final.
Consider making the field private, as it is possible that such a field could be manipulated to produce unintended results.
Bad Practice
Here, the NUM_RETRIES field could be manipulated to perform a Denial of Service (DoS) attack when set to some very high number.
class SomeClass {
public static int NUM_RETRIES = 3;
}
// Elsewhere...
SomeClass someObj = ...;
SomeClass.NUM_RETRIES = Integer.MAX_VALUE; // This could make an application hang!
Recommended
There are multiple ways to avoid this, and you must choose the best method as per your requirements.
Make the field final
If you do not need the field to be mutable, consider just making it final:
public static final int NUM_RETRIES = 3;
Make the field private
If you require the field to be mutable, consider making the field private. If you also need to expose the field to API consumers, consider adding a static or instance getter method for the field:
private static int NUM_RETRIES = 3;
// Static getter
public static final int getNumRetries() {
return NUM_RETRIES;
}
// Instance getter, only usable when we have an instance of this class created.
public final int getNumRetries() {
return NUM_RETRIES;
}
If you also need to be able to set the value, make sure to sanitize the assigned data. You could check if the retry value is within a maximum permissible limit (MAX_NUM_RETRIES) and if the assigned value is below 0 or above the maximum limit, clamp that value to within those limits.
public static final void setNumRetries(int retries) {
// clamp retries to within the range 0 to MAX_NUM_RETRIES.
retries = (retries > MAX_NUM_RETRIES) ? MAX_NUM_RETRIES : ((retries < 0) ? 0 : retries);
NUM_RETRIES = retries;
}