The roles list anyone can change
A easy Java puzzle in the shared and static mutable state family. One line below contains a real bug. Try to spot it first, then read why it fails and how to fix it.
Highlighted: line 4. Play this one as a puzzle without the answer.
What is wrong
final prevents reassigning the reference, but the list itself is mutable and public. Any code can call Roles.ADMIN_ROLES.add("GUEST") and silently grant administrator rights for the whole process.
The fix
How to avoid it next time
final does not mean immutable. Use List.of, Set.of or Collections.unmodifiableList for constants.
Want the background? Read static and final members in the Java concepts library.
About shared and static mutable state
Static fields and singleton beans are shared by every request and thread. Mutable state kept there leaks data between users, makes tests order-dependent and creates race conditions that appear only under load.
In code review: Look for non-final static fields and instance fields in singleton beans that are written during a request. Prefer local variables, immutable objects and explicit synchronization.
More puzzles in this family
Frequently asked questions
What is the bug in "The roles list anyone can change"?
final prevents reassigning the reference, but the list itself is mutable and public. Any code can call Roles.ADMIN_ROLES.add("GUEST") and silently grant administrator rights for the whole process. The faulty line is line 4: public static final List
How do I fix it?
Replace it with: public static final List
How do I catch shared and static mutable state in code review?
Look for non-final static fields and instance fields in singleton beans that are written during a request. Prefer local variables, immutable objects and explicit synchronization.
Is there a new puzzle every day?
Yes. The daily Spot the Bug puzzle picks one of these snippets for each UTC day, with the difficulty set by the weekday. Your streak is stored only in your browser.