Returning references to internal mutable members of a class can compromise an application's security, both by breaking encapsulation and also by providing the opportunity to corrupt the internal state of the class (whether accidentally or maliciously). Performing Therefore, programs must not return references to internal mutable classes.
Returning a defensive copy before returning of a reference to a mutable internal state ensures that the caller can only modify the copy and not the original internal state.
| Wiki Markup |
|---|
Pugh \[[Pugh 2009|AA. Bibliography#Pugh 09]\] cites a vulnerability discovered by the Findbugs static analysis tool in the early betas of JDK 1.7 where the {{sun.security.x509.InvalidityDateExtension}} class returned a {{Date}} instance through a {{public}} accessor without creating defensive copies. |
Noncompliant Code Example
...
Sound automated detection is infeasible; heuristic checks could be useful.
Related Vulnerabilities
| Wiki Markup |
|---|
Pugh \[[Pugh 2009|AA. Bibliography#Pugh 09]\] cites a vulnerability discovered by the Findbugs static analysis tool in the early betas of JDK 1.7 where the {{sun.security.x509.InvalidityDateExtension}} class returned a {{Date}} instance through a {{public}} accessor without creating defensive copies. |
Related Guidelines
CWE ID 375, "Returning a Mutable Object to an Untrusted Caller" |
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="fcc92c1177459800-7b4365c9-415147cd-8da9aea5-86400dca3db8c5dc53a110d5"><ac:plain-text-body><![CDATA[ | [[API 2006 | AA. Bibliography#API 06]] | [method clone() | http://java.sun.com/javase/6/docs/api/java/lang/Object.html#clone()] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="fa8da04bef2250c7-6091ab5a-47a040c3-9d288e3a-7ce48be699451e4bdae6d8b7"><ac:plain-text-body><![CDATA[ | [[Bloch 2008 | AA. Bibliography#Bloch 08]] | Item 39: Make defensive copies when needed | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5eef8e53c88c2348-f86a63a3-45794fed-8301b943-a76be031391d0bb3038eb038"><ac:plain-text-body><![CDATA[ | [[Goetz 2006 | AA. Bibliography#Goetz 06]] | 3.2. Publication and Escape: Allowing Internal Mutable State to Escape | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="097e9fa19df51ff9-d37643b1-413c41aa-ad35a075-4497908f43c8b984c387a95d"><ac:plain-text-body><![CDATA[ | [[Gong 2003 | AA. Bibliography#Gong 03]] | 9.4 Private Object State and Object Immutability | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="91db85a98e17d32e-1ebe887f-47124d0e-aa3f8cfc-1a27732888fa6c8284e57f03"><ac:plain-text-body><![CDATA[ | [[Haggar 2000 | AA. Bibliography#Haggar 00]] | [Practical Java Praxis 64: Use clone for Immutable Objects When Passing or Receiving Object References to Mutable Objects | http://www.informit.com/articles/article.aspx?p=20530] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="7b6eebf960e95a52-134251c3-4aae4985-afb0bc86-09f2719b571cd8393534e8ca"><ac:plain-text-body><![CDATA[ | [[Security 2006 | AA. Bibliography#Security 06]] |
| ]]></ac:plain-text-body></ac:structured-macro> |
...