EjbStaticFieldNonFinal.ql

/**
 * @name EJB uses non-final static field
 * @description An EJB should not make use of non-final static fields,
 *              since a consistent state of such fields is not guaranteed
 *              if an EJB instance is distributed across multiple JVMs.
 * @kind problem
 * @problem.severity error
 * @precision low
 * @id java/ejb/non-final-static-field
 * @tags reliability
 *       external/cwe/cwe-573
 */
import java
import semmle.code.java.frameworks.javaee.ejb.EJB
import semmle.code.java.frameworks.javaee.ejb.EJBRestrictions

/*
JSR 220: Enterprise JavaBeansTM,Version 3.0
EJB Core Contracts and Requirements
Section 21.1.2 Programming Restrictions

- An enterprise bean must not use read/write static fields. Using read-only static fields is
allowed. Therefore, it is recommended that all static fields in the enterprise bean class be
declared as final.

This rule is required to ensure consistent runtime semantics because while some EJB containers may
use a single JVM to execute all enterprise bean's instances, others may distribute the instances across
multiple JVMs.
*/

from Callable origin, ForbiddenStaticFieldCallable target, Call call, FieldAccess fa, Field f
where
  ejbCalls(origin, target, call) and
  fa = forbiddenStaticFieldUse(target) and
  fa.getField() = f
select origin, "EJB should not access non-final static field $@ $@.",
  f, f.getDeclaringType().getName() + "." + f.getName(),
  fa, "here"