Page History

Returning references to internal mutable members of a class can compromise an application's security, both by breaking encapsulation and by providing the opportunity to corrupt the internal state of the class (whether accidentally or maliciously). ThereforeAs a result, programs must not return references to internal mutable classes.

...

This noncompliant code example shows a getDate() accessor method that returns the sole instance of the private Date object.

class MutableClass {
  private Date d;

  public MutableClass() {
    d = new Date();
  }

  public Date getDate() {
    return d;
  }
}

...

This compliant solution returns a clone of the Date object from the getDate() accessor method. While Date can be extended by an attacker, this is safe because the Date object returned by getDate() is controlled by MutableClass and is known to be a nonmalicious subclass.

protectedpublic Date getDate() {
  return (Date)d.clone();
}

Note that defensive copies performed during execution of a constructor must avoid use of the clone() method when the class could be subclassed by untrusted code. This restriction prevents execution of a maliciously crafted overriding of the clone() method. For more details, see rule OBJ00OBJ07-J. Limit extensibility of classes and methods with invariants to trusted subclasses only."

Classes that have public setter methods, that is, methods whose purpose is to change class fields, must follow the related advice found in rule OBJ06-J. Defensively copy mutable inputs and mutable internal components. Note that setter methods can (and usually should) perform input validation and sanitization before setting internal fields.

...

class MutableClass {
  private Date[] date;

  public MutableClass() {
    date = new Date[20];
    for (int i = 0; i < 20date.length; i++){
      date[i] = new Date();
    }
  }

  public Date[] getDate() {
    return date; // or return date.clone()
  }
}

...

class MutableClass {
  private Date[] date;

  public MutableClass() {
    date = new Date[20];
    for(int i = 0; i < 20date.length; i++) {
      date[i] = new Date();
    }
  }

  public Date[] getDate() {
    Date[] dates = new Date[20date.length];
    for (int i = 0; i < 20date.length; i++) {
      dates[i] = (Date) date[i].clone();
    }
    return dates;
  }
}

...

In this noncompliant code example, class ReturnRef contains a private Hashtable instance field. The hash table stores immutable but sensitive data (for example, social security numbers SSNs). A getter method The getValues() method gives the caller access to the hash table by returning a reference to it. An untrusted caller can use the getter this method to gain access to the hash table; as a result, hash table entries can be maliciously added, removed, or replaced. Furthermore, multiple threads can perform these modifications, providing ample opportunities for race conditions.

...

class ReturnRef {
  // ...
  private Hashtable<Integer,String> getValues(){
    return (Hashtable<Integer, String>) ht.clone(); // shallow copy
  }

  public static void main(String[] args) {
    ReturnRef rr = new ReturnRef();
    // printsPrints non-sensitive data
    Hashtable<Integer,String> ht1 = rr.getValues(); 
    // untrustedUntrusted caller can only modify copy
    ht1.remove(1); 
    // printsPrints non-sensitive data
    Hashtable<Integer,String> ht2 = rr.getValues(); 
  }
}

...

Note that making deep copies of the keys of a hash table is unncessary; shallow copying of the references suffices because a hash table's contract dictates that its keys must produce consistent results to the equals() and hashCode() functions methods. Mutable objects whose equals() or hashCode() method results may be modified are not suitable keys.

...

...