Page History

CERT C++ Secure Coding Standard

"OOP35-CPP. Do not return references to private data."

MITRE CWE

CWE ID 375, "Returning a Mutable Object to an Untrusted Caller"

Secure Coding Guidelines, V 2.0 SCG 2007

Guideline 2-1 Create a copy of mutable inputs and outputs

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="38b09fcc714b9db5-f8cdbdad-451b4908-aac59b93-dc9b038bf5fdb7ce703bb1fd"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

[method clone()

http://java.sun.com/javase/6/docs/api/java/lang/Object.html#clone()]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0c4759a23ba5871b-7eb620ba-47d14d5f-8b33ad58-a7bac8c3ea4909aceab37882"><ac:plain-text-body><![CDATA[

[[Bloch 2008

AA. Bibliography#Bloch 08]]

Item 39: Make defensive copies when needed

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3ea720f00bada502-1fb4998a-4e5e4617-afe88054-bb14a5d3ccb2930e7ec6d1c2"><ac:plain-text-body><![CDATA[

[[Goetz 2006

AA. Bibliography#Goetz 06]]

3.2. Publication and Escape: Allowing Internal Mutable State to Escape

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="50feee211be4328e-5801a906-4fb1403d-9ec9a1f1-b0f395a0b4b75fecc1331c08"><ac:plain-text-body><![CDATA[

[[Gong 2003

AA. Bibliography#Gong 03]]

9.4 Private Object State and Object Immutability

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c81ade935616e02c-d29424aa-40ab4095-8aa88f0d-a128fb625df8da8a8bbd5a77"><ac:plain-text-body><![CDATA[

[[Haggar 2000

AA. Bibliography#Haggar 00]]

[Practical Java Praxis 64: Use clone for Immutable Objects When Passing or Receiving Object References to Mutable Objects

http://www.informit.com/articles/article.aspx?p=20530]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="7a418eea0da01920-097ee1cf-4c6d482c-adf596fd-5c765c872fe95e20591d0060"><ac:plain-text-body><![CDATA[

[[Security 2006

AA. Bibliography#Security 06]]

]]></ac:plain-text-body></ac:structured-macro>