CWE-582 is a Java mistake built on a common misunderstanding of final. An array declared public, final and static looks like a constant. It is not.
MITRE explains why. Arrays are mutable objects. final means the array reference can be assigned only once. It makes no promise about the values inside. Because the array is public, a malicious program can change the elements. MITRE concludes that in most cases such a declaration is a bug.
How it happens
MITRE's example is a Java applet:
public final class urlTool extends Applet {
public final static URL[] urls;
...
}
Any other class can run urlTool.urls[0] = new URL("http://attacker.example/"). The compiler allows it, because it does not reassign the array, only an element.
The same applies to any array of settings, allowed hosts, role names or defaults that other code can reach.
What an attacker gains
MITRE lists integrity impact: modifying application data. If the array drives security decisions, such as a list of trusted URLs, allowed file types or permitted origins, a change in one place affects every user of that value in the same JVM. In mobile or plugin code, where untrusted code runs beside yours, this is a real route to tampering.
How to find it
MITRE says automated static analysis can find some instances. A search for public static final followed by [] finds the pattern quickly. Many analyzers have a specific rule for it.
How to fix it
MITRE's mitigation: in most situations the array should be made private.
- Make the array
private. - Expose a copy, or an unmodifiable view, through a method.
- Prefer an immutable collection type for constants.
// Fixed: private array, defensive copy
private static final URL[] URLS = { ... };
public static URL[] getUrls() {
return URLS.clone();
}
// Or an unmodifiable list
public static final java.util.List<URL> URLS =
java.util.List.of(url1, url2);
List.of returns an immutable list, so callers cannot change it.
The free in-browser scan at gold.safeguard.sh/scan lists the dependencies in your manifest. No login is needed, the file stays on your machine, and it handles up to 100 dependencies.
Quick check
Does final protect array contents?
No. It only stops reassigning the reference. Elements can still be changed.
What is the fix?
Make the array private and return a copy, or use an immutable list.
