...
Code Block | ||
---|---|---|
| ||
public void deepCopy(int[] ints, HttpCookie[] cookies) { if (ints == null || cookies == null) { throw new NullPointerException(); } // Shallow copy int[] intsCopy = ints.clone(); // Deep copy HttpCookie[] cookiesCopy = new HttpCookie[cookies.length]; for (int i = 0; i << cookies.length; i++) { // Manually create copy of each element in array cookiesCopy[i] = (HttpCookie)cookies[i].clone(); } doLogic(intsCopy, cookiesCopy); } |
...
Code Block | ||
---|---|---|
| ||
// java.util.Collection is an interface public void copyInterfaceInput(Collection<String>Collection<String> collection) { doLogic(collection); } |
...
Code Block | ||
---|---|---|
| ||
public void copyInterfaceInput(Collection<String>Collection<String> collection) { // Convert input to trusted implementation collection = new ArrayList(collection); doLogic(collection); } |
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
Wiki Markup |
---|
\[[SCG 07|AA. Java References#SCG 07]\] Guideline 2-1 Create a copy of mutable inputs and outputs \[[Bloch 08|AA. Java References#Bloch 08]\] Item 39: Make defensive copies when needed \[[Pugh 09|AA. Java References#Pugh 09]\] Returning references to internal mutable state |
...
FIO30-J. Do not log sensitive information 09. Input Output (FIO) FIO32-J. Ensure all resources are properly closed when they are no longer needed