COMMON WEAKNESS ENUMERATIONIncomplete

CWE-583

finalize() Method Declared Public

The product violates secure coding principles for mobile code by declaring a finalize() method public.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product violates secure coding principles for mobile code by declaring a finalize() method public.

Extended description

A product should never call finalize explicitly, except to call super.finalize() inside an implementation of finalize(). In mobile code situations, the otherwise error prone practice of manual garbage collection can become a security threat if an attacker can maliciously invoke a finalize() method because it is declared with public access.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Alter Execution LogicExecute Unauthorized Code or CommandsModify Application Data

Affected security scopes: Confidentiality, Integrity, Availability

Defence

How is it prevented and fixed?

Implementation

Implementation-phase defence

Detail
If you are using finalize() as it was designed, there is no reason to declare finalize() with anything other than protected access.

Verification

How is it detected?

Automated Static Analysis

High
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)