...
Returning references that refer to private data to untrusted code can be more pernicious than returning the references to trusted code. If a class defines a clone() method that trusted code can use to pass defensive copies of the instance to untrusted code (OBJ36OBJ10-J. Provide mutable classes with a clone method to allow passing instances to untrusted code safely), the implementing class may violate this guideline. However, the burden is now transferred to the trusted code as it is expected to reliably call the clone() method before operating on the instance or passing it to untrusted code.
...
If the hash table contained references to mutable data such as a series of Date objects, every one of those objects must be copied by using a copy constructor or method. For further details, refer to FIO31-J. Defensively copy mutable inputs and mutable internal components and OBJ36OBJ10-J. Provide mutable classes with a clone method to allow passing instances to untrusted code safely. Note that the keys of a hash table need not be deep copied; shallow copying of the references suffices because a hash table's contract dictates that it cannot hold duplicate keys.
...
EX2: If the performance of the clone() method is within reasonable bounds and the class clearly documents its use, this guideline may be violated. (OBJ36OBJ10-J. Provide mutable classes with a clone method to allow passing instances to untrusted code safely)
...
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] [method clone()|http://java.sun.com/javase/6/docs/api/java/lang/Object.html#clone()] \[[Security 06|AA. Java References#Security 06]\] \[[Bloch 08|AA. Java References#Bloch 08]\] Item 39: Make defensive copies when needed \[[SCG 07|AA. Java References#SCG 07]\] Guideline 2-1 Create a copy of mutable inputs and outputs \[[Haggar 00|AA. Java References#Haggar 00]\] [Practical Java Praxis 64: Use clone for Immutable Objects When Passing or Receiving Object References to Mutable Objects|http://www.informit.com/articles/article.aspx?p=20530] \[[Goetz 06|AA. Java References#Goetz 06]\] 3.2. Publication and Escape: Allowing Internal Mutable State to Escape \[[Gong 03|AA. Java References#Gong 03]\] 9.4 Private Object State and Object Immutability \[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 375|http://cwe.mitre.org/data/definitions/375.html] "Passing Mutable Objects to an Untrusted Method" |
...
OBJ36OBJ10-J. Provide mutable classes with a clone method to allow passing instances to untrusted code safely 08. Object Orientation (OBJ) OBJ09-J. Immutable classes must prohibit extension