Skip to content

Vulnerabilities: constants are not constant, instantiation related problems #54

Closed
@rabbitvirus

Description

@rabbitvirus

Hello,

I found some vulnerabilities and tech debt in the existing code.

List of problems I would love to solve:

  • publicly accessible fields that should not be modifiable are not constant. User can assign custom objects and change behaviour in runtime. Pretty much every single scalar is initialized statically but not assigned to a final field. Also, constants registry ExtendedScalars has the same problem - one can assign anything to static fields and cause difficult to detect problems.
  • internal classes with static content only should not have default public constructors available. It is a minor problem, but definitely should be resolved with private constructors - utility classes/holders should not be instantiable.
  • internal utility classes with scalars definitions should be final.
  • some numeric comparisons can be simplified.

I made some changes here:
#53

NOTE: they should not break backwards compatibility.

Another good idea could be to replace ugly static initializer blocks with static factory methods or lazy holders. But let's leave it for now.

I am looking forward to your comments and review :-)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions