Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-586:Explicit Call to Finalize()
Weakness ID:586
Version:v4.17
Weakness Name:Explicit Call to Finalize()
Vulnerability Mapping:Allowed
Abstraction:Base
Structure:Simple
Status:Draft
Likelihood of Exploit:
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

The product makes an explicit call to the finalize() method from outside the finalizer.

▼Extended Description

While the Java Language Specification allows an object's finalize() method to be called from outside the finalizer, doing so is usually a bad idea. For example, calling finalize() explicitly means that finalize() will be called more than once: the first time will be the explicit call and the last time will be the call that is made after the object is garbage collected.

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
ChildOfProhibitedC1076Insufficient Adherence to Expected Conventions
ParentOfAllowed-with-ReviewC675Multiple Operations on Resource in Single-Operation Context
Nature: ChildOf
Mapping: Prohibited
Type: Class
ID: 1076
Name: Insufficient Adherence to Expected Conventions
Nature: ParentOf
Mapping: Allowed-with-Review
Type: Class
ID: 675
Name: Multiple Operations on Resource in Single-Operation Context
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC850The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET)
MemberOfProhibitedC1001SFP Secondary Cluster: Use of an Improper API
MemberOfProhibitedC1006Bad Coding Practices
MemberOfProhibitedC1140SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)
MemberOfProhibitedC1412Comprehensive Categorization: Poor Coding Practices
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 850
Name: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1001
Name: SFP Secondary Cluster: Use of an Improper API
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1006
Name: Bad Coding Practices
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1140
Name: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1412
Name: Comprehensive Categorization: Poor Coding Practices
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-315Unexpected State (impact)
MemberOfProhibitedBSBOSS-325Quality Degradation (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-315
Name: Unexpected State (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-325
Name: Quality Degradation (impact)
▼Relevant To View
Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"
NatureMappingTypeIDName
MemberOfProhibitedC1001SFP Secondary Cluster: Use of an Improper API
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1001
Name: SFP Secondary Cluster: Use of an Improper API
Relevant to the view"Software Development - (699)"
NatureMappingTypeIDName
MemberOfProhibitedC1006Bad Coding Practices
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1006
Name: Bad Coding Practices
Relevant to the view"Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java - (1133)"
NatureMappingTypeIDName
MemberOfProhibitedC1140SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1140
Name: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)
▼Background Detail

▼Common Consequences
ScopeLikelihoodImpactNote
IntegrityOtherN/AUnexpected StateQuality Degradation
N/A
Scope: Integrity, Other
Likelihood: N/A
Impact: Unexpected State, Quality Degradation
Note:
N/A
▼Potential Mitigations
Phase:Implementation, Testing
Mitigation ID:
Strategy:
Effectiveness:
Description:

Do not make explicit calls to finalize(). Use static analysis tools to spot such instances.

Note:

▼Modes Of Introduction
Phase: Implementation
Note:

N/A

▼Applicable Platforms
Languages
Class: Java(Undetermined Prevalence)
▼Demonstrative Examples
Example 1

The following code fragment calls finalize() explicitly:

Language: ( code)
N/A

Language: Java(Bad code)
// time to clean up* widget.finalize();

▼Observed Examples
ReferenceDescription
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      Primary
      N/A
      Ordinality: Primary
      Description:
      N/A
      ▼Detection Methods
      Automated Static Analysis
      Detection Method ID:DM-14
      Description:

      Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

      Effectiveness:High
      Note:

      N/A

      ▼Vulnerability Mapping Notes
      Usage:Allowed
      Reason:Acceptable-Use
      Rationale:

      This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

      Comments:

      Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

      Suggestions:
      ▼Notes
      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      The CERT Oracle Secure Coding Standard for Java (2011)MET12-JN/ADo not use finalizers
      Software Fault PatternsSFP3N/AUse of an improper API
      Taxonomy Name: The CERT Oracle Secure Coding Standard for Java (2011)
      Entry ID: MET12-J
      Fit: N/A
      Entry Name: Do not use finalizers
      Taxonomy Name: Software Fault Patterns
      Entry ID: SFP3
      Fit: N/A
      Entry Name: Use of an improper API
      ▼Related Attack Patterns
      IDName
      ▼References
      Details not found