-
Type:
Code Smell Detection
-
Status: Active
-
Resolution: Unresolved
-
Message:Make this "public static XXX" field [final|const]
-
Default Severity:Minor
-
Impact:Low
-
Likelihood:Low
-
Default Quality Profiles:Sonar way
-
Targeted languages:C#, C++
-
Covered Languages:Flex, Java
-
Remediation Function:Constant/Issue
-
Constant Cost:20min
-
Analysis Scope:Main Sources
-
CERT:OBJ10-J.
-
CWE:CWE-500
-
FindBugs:MS_SHOULD_BE_REFACTORED_TO_BE_FINAL,MS_SHOULD_BE_FINAL,MS_CANNOT_BE_FINAL
There is no good reason to declare a field "public" and "static" without also declaring it "const". Most of the time this is a kludge to share a state among several objects. But with this approach, any object can do whatever it wants with the shared state, such as setting it to null.
See
- MITRE, CWE-500 - Public Static Field Not Marked Final
- CERT OBJ10-J. - Do not use public static nonfinal fields
- is implemented by
-
SONARFLEX-164 Rule S1444 change type from vulnerability to code smell
-
- Closed
-
-
SONARJAVA-3343 Change issue type of S1444 to code smell
-
- Closed
-
- is related to
-
SONARJAVA-1615 Introduce issue filtering mechanism to avoid modifying multiple rules when handling frameworks
-
- Closed
-
- relates to
-
RSPEC-1170 Public constants and fields initialized at declaration should be "static final" rather than merely "final"
- Active
1.
|
Java | RSPEC-2378 |
|
Active | Unassigned | |
2.
|
Flex | RSPEC-5992 |
|
Active | Unassigned |