11import java.util.HashMap;
12
13public class AuthManager {
14 public static AuthManager instance; 15
16 protected HashMap<String, AuthLoginSession> pending_tokens = new HashMap<>();
17 protected HashMap<String, String> active_tokens = new HashMap<>();17public class HttpApi {
18
19 public static HttpApi instance;
20 public static int port;21 public HttpServer server;
22 public HttpContext context;
23 public HashMap<String, HttpApiHandler> handlers = new HashMap<String, HttpApiHandler>();16
17public class HttpApi {
18
19 public static HttpApi instance;20 public static int port;
21 public HttpServer server;
22 public HttpContext context; 8import java.io.IOException;
9
10public class TranslateApi {
11 public static String[] languages = new String[]{12 "de",13 "en",14 "es",15 "fr",16 "it",17 "ja",18 "ko",19 "pt",20 "ru",21 "zh"22 };23
24 public String translate(String message, String to) throws IOException, JsonSyntaxException {
25 message = message.replace("#", "%23"); 8import java.io.IOException;
9
10public class CoronaApi {
11 public static String[] countries = new String[]{12 "germany",13 "usa",14 "italy",15 "spain",16 "france",17 "uk",18 "sweden",19 "norway",20 "denmark",21 "switzerland",22 "austria",23 "netherlands",24 "ireland",25 "poland",26 "finland",27 "serbia",28 "montenegro",29 "bulgaria",30 "greece",31 "malta",32 "cyprus",33 "macedonia",34 "slovenia",35 "russia"36 };37
38 public CoronaApiResult fetchCountry(String country) throws IOException, JsonSyntaxException {
39 String res = HttpClient.get("https://disease.sh/v3/covid-19/countries/" + country);This code contains a public static field which is not final, or is mutable even when declared as final.
Consider making the field private, as it is possible that such a field could be manipulated to produce unintended results.
Bad Practice
Here, the NUM_RETRIES field could be manipulated to perform a Denial of Service (DoS) attack when set to some very high number.
class SomeClass {
public static int NUM_RETRIES = 3;
}
// Elsewhere...
SomeClass someObj = ...;
SomeClass.NUM_RETRIES = Integer.MAX_VALUE; // This could make an application hang!
Recommended
There are multiple ways to avoid this, and you must choose the best method as per your requirements.
Make the field final
If you do not need the field to be mutable, consider just making it final:
public static final int NUM_RETRIES = 3;
Make the field private
If you require the field to be mutable, consider making the field private. If you also need to expose the field to API consumers, consider adding a static or instance getter method for the field:
private static int NUM_RETRIES = 3;
// Static getter
public static final int getNumRetries() {
return NUM_RETRIES;
}
// Instance getter, only usable when we have an instance of this class created.
public final int getNumRetries() {
return NUM_RETRIES;
}
If you also need to be able to set the value, make sure to sanitize the assigned data. You could check if the retry value is within a maximum permissible limit (MAX_NUM_RETRIES) and if the assigned value is below 0 or above the maximum limit, clamp that value to within those limits.
public static final void setNumRetries(int retries) {
// clamp retries to within the range 0 to MAX_NUM_RETRIES.
retries = (retries > MAX_NUM_RETRIES) ? MAX_NUM_RETRIES : ((retries < 0) ? 0 : retries);
NUM_RETRIES = retries;
}