Kingdom: Code Quality
Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an attacker it provides an opportunity to stress the system in unexpected ways.
Code Correctness: Incorrect serialPersistentFields Modifier
Abstract
To use
serialPersistentFields correctly, it must be declared private, static, and final.Explanation
The Java Object Serialization Specification enables developers to manually define Serializable fields for a class by specifying them in the
Example 1: The following declaration of
serialPersistentFields array. This feature will only work if serialPersistentFields is declared as private, static, and final.Example 1: The following declaration of
serialPersistentFields will not be used to define Serializable fields because it is not private, static, and final.
class List implements Serializable {
public ObjectStreamField[] serialPersistentFields = { new ObjectStreamField("myField", List.class) };
...
}
References
desc.structural.java.code_correctness_incorrect_serialpersistentfields_modifier