mirror of
https://github.com/github/codeql.git
synced 2026-03-08 00:26:45 +01:00
39 lines
1.4 KiB
Plaintext
39 lines
1.4 KiB
Plaintext
/**
|
|
* @name EJB uses non-final static field
|
|
* @description An EJB should not make use of non-final static fields,
|
|
* since a consistent state of such fields is not guaranteed
|
|
* if an EJB instance is distributed across multiple JVMs.
|
|
* @kind problem
|
|
* @problem.severity error
|
|
* @precision low
|
|
* @id java/ejb/non-final-static-field
|
|
* @tags reliability
|
|
* external/cwe/cwe-573
|
|
*/
|
|
|
|
import java
|
|
import semmle.code.java.frameworks.javaee.ejb.EJB
|
|
import semmle.code.java.frameworks.javaee.ejb.EJBRestrictions
|
|
|
|
/*
|
|
* JSR 220: Enterprise JavaBeansTM,Version 3.0
|
|
* EJB Core Contracts and Requirements
|
|
* Section 21.1.2 Programming Restrictions
|
|
*
|
|
* - An enterprise bean must not use read/write static fields. Using read-only static fields is
|
|
* allowed. Therefore, it is recommended that all static fields in the enterprise bean class be
|
|
* declared as final.
|
|
*
|
|
* This rule is required to ensure consistent runtime semantics because while some EJB containers may
|
|
* use a single JVM to execute all enterprise bean's instances, others may distribute the instances across
|
|
* multiple JVMs.
|
|
*/
|
|
|
|
from Callable origin, ForbiddenStaticFieldCallable target, Call call, FieldAccess fa, Field f
|
|
where
|
|
ejbCalls(origin, target, call) and
|
|
fa = forbiddenStaticFieldUse(target) and
|
|
fa.getField() = f
|
|
select origin, "EJB should not access non-final static field $@ $@.", f,
|
|
f.getDeclaringType().getName() + "." + f.getName(), fa, "here"
|