Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migrated to Confluence 4.0

...

Code Block
bgColor#ccccff
public final class MutableClass implements Cloneable {
  private Date date;

  public MutableClass(Date d) {
    this.date = new Date(d.getTime());
  }

  public Date getDate() {
    return (Date) date.clone();
  }

  public void setDate(Date d) {
    this.date = (Date) d.clone();
  }

  public Object clone() throws CloneNotSupportedException {
    final MutableClass cloned = (MutableClass) super.clone();
    cloned.date = (Date) date.clone();  // manually copy mutable Date object
    return cloned;
  }
}

Wiki MarkupNote that the {{clone()}} method must manually clone the {{Date}} object. This step is usually unnecessary when the object contains only primitive fields or fields that refer to immutable objects. However, when the fields contain data such as unique identifiers or object creation times, the {{clone()}} method must calculate and assign appropriate new values for such fields \[ [Bloch 2008|AA. References#Bloch 08]\].

Mutable classes that define a clone() method must be declared final. This ensures that untrusted code cannot declare a subclass that overrides the clone() method to create a spurious instance. The clone() method should copy all internal mutable state as necessary — in this compliant example, the Date object.

...

Code Block
bgColor#ccccff
public final class MutableClass implements Cloneable {
  private final Date date; // final field

  public MutableClass(Date d) {
    this.date = new Date(d.getTime());  // copy-in
  }

  public Date getDate() {
    return (Date) date.clone(); // copy and return
  }

  public Object clone() {
    Date d = (Date) date.clone();
    MutableClass cloned = new MutableClass(d);
    return cloned;
  }
}

Wiki MarkupCallers can use the {{clone()}} method to obtain an instance of such a mutable class. The {{clone()}} method must create a new instance of the final member class and copy the original state to it. The new instance is necessary because there might not be an accessible copy method available in the member class. If the member class evolves in the future, it is critical to include the new state in the manual copy. Finally, the {{clone()}} method must create and return a new instance of the enclosing class ({{MutableClass}}) using the newly created member instance ({{d}}) \ [[SCG 2009|AA. References#SCG 09]\].

Mutable classes that define a clone() method must be declared final.

...

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

OBJ04-J

low

likely

medium

P6

L2

Automated Detection

Sound automated detection is infeasible in the general case. Heuristic approaches could be useful.

...

MITRE CWE

CWE-374. Passing Mutable Objects to an Untrusted Method

 

CWE-375. Returning a Mutable Object to an Untrusted Caller

Secure Coding Guidelines for the Java Programming Language, Version 3.0

Guideline 2-3. Support copy functionality for a mutable class

Bibliography

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="d7051527-08c7-4071-ab5f-004e62e8bd79"><ac:plain-text-body><! [CDATA[ [[API 2006AA. References#API 06]]

[Method clone()http://java.sun.com/javase/6/docs/api/java/lang/Object.html#clone()]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="1f9cf922-b714-432a-b00f-af2680c7c913"><ac:plain-text-body><![CDATA[

[ [Bloch 2008AA. References#Bloch 08] ]

Item 39. Make defensive copies when needed, Item 11. Override clone judiciously

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="08ad3c6e-d288-412b-8e55-56cf09781c7f"><ac:plain-text-body><![CDATA[

[ [Security 2006

AA. References#Security 06]]

]] ></ac:plain-text-body></ac:structured-macro>

...

OBJ03-J. Do not mix generic with nongeneric raw types in new code      04. Object Orientation (OBJ)      OBJ05-J. Defensively copy private mutable class members before returning their references