...
| Code Block | ||
|---|---|---|
| ||
class Modifiable {
private List<Integer>List<Integer> list = new ArrayList<Integer>ArrayList<Integer>();
public void listIt() {
addSomething(list);
// ...
}
private void addSomething(Collection<Integer>Collection<Integer> collection) {
collection.add(1);
}
}
|
...
| Code Block | ||
|---|---|---|
| ||
// ...
public void listIt() {
addSomething(Collections.unmodifiableCollection(list));
// ...
}
private void addSomething(Collection<Integer>Collection<Integer> collection) {
collection.add(1); // throws java.lang.UnsupportedOperationException
}
|
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[Tutorials 08|AA. Java References#Tutorials 08]\] [Unmodifiable Wrappers|http://java.sun.com/docs/books/tutorial/collections/implementations/wrapper.html] |
...
SEC00-J. Follow the principle of least privilege 02. Platform Security (SEC) SEC02-J. Do not expose standard APIs that may bypass Security Manager checks to untrusted code