CWE-583—finalize() Method Declared Public

名称

finalize() Method Declared Public

描述

The product violates secure coding principles for mobile code by declaring a finalize() method public.

A product should never call finalize explicitly, except to call super.finalize() inside an implementation of finalize(). In mobile code situations, the otherwise error prone practice of manual garbage collection can become a security threat if an attacker can maliciously invoke a finalize() method because it is declared with public access.

常见后果

范围：

Confidentiality, Integrity, Availability

影响：

Alter Execution Logic, Execute Unauthorized Code or Commands, Modify Application Data

相关 CWE

• CWE-668Exposure of Resource to Wrong Sphere