...
Additionally, an object's state may get corrupted if it returns references to internal mutable components. Accessors must consequently return defensive copies of internal mutable objects. (See guideline OBJ11-J. Defensively copy private mutable class members before returning their references.)
Noncompliant Code Example
...
The problem is alleviated by creating a copy of the mutable input and using it to perform operations so that the original object is left unscathed. This can be realized by implementing the java.lang.Cloneable interface and declaring a public clone method if the class is final or by using a copy constructor. Performing a manual copy of the object state within the caller becomes necessary if the mutable class is declared final (that . That is, it cannot provide an accessible copy method). See the guideline OBJ10-J. Provide mutable classes with copy functionality to allow passing instances to untrusted code safely for more information. Note that any input validation must be performed on the copy and not the original object.
...
Failing to create a copy of a mutable input may enable an attacker to exploit a TOCTOU vulnerability and at other times, expose internal mutable components to untrusted code.
Rule Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
FIO00-J | medium | probable | high | P4 | L3 |
...