...
Returning references to internal object state (mutable or immutable) can render an application susceptible to information leaks and corruption of its objects' states, which consequently violates class invariants. Control flow can also be affected in some cases.
...
Related Vulnerabilities
Pugh [Pugh 2009] cites a vulnerability discovered by the Findbugs static analysis tool in the early betas of JDK 1.7 where the sun.security.x509.InvalidityDateExtension class returned a Date instance through a public accessor without creating defensive copies.
Related Guidelines
CWE-375. Returning a mutable object to an untrusted caller |
Bibliography
[API 2006] | |
Item 39. Make defensive copies when needed | |
3.2, Publication and Escape: Allowing Internal Mutable State to Escape | |
9.4, Private Object State and Object Immutability | |
|
...