COMMON WEAKNESS ENUMERATIONDraft

CWE-568

finalize() Method Without super.finalize()

The product contains a finalize() method that does not call super.finalize().

Soyutlama

Variant

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product contains a finalize() method that does not call super.finalize().

Genişletilmiş açıklama

The Java Language Specification states that it is a good practice for a finalize() method to call super.finalize().

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Quality Degradation

Etkilenen güvenlik alanları: Other

Savunma

Nasıl önlenir ve çözülür?

Implementation

Uygulama aşaması savunması

Detay
Call the super.finalize() method.

Doğrulama

Nasıl tespit edilir?

Automated Static Analysis

High
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)