Mutable classes allow code external to the class to alter their instance or class fields. Provide means for creating copies of mutable classes so that 'disposable' instances of such classes can be passed to untrusted code. This functionality is useful when methods in other classes need to must create copies of the particular class instance ; (see guidelines FIO00 OBJ06-J. Defensively copy mutable inputs and mutable internal components and OBJ09OBJ05-J. Defensively copy Do not return references to private mutable class members before returning their references for additional details).
Mutable classes must provide either a copy constructor or a public static factory method that returns a copy of an instance. Alternatively, final classes may advertise their copy functionality by overriding the clone()
method of java.lang.Object
's clone()
method. Use of the clone()
method is secure only for final classes; non-final nonfinal classes must not take this approach (see OBJ03-J. Sensitive classes must not let themselves be copied.)
Trusted callers can be trusted to use the provided copy functionality to make defensive copies before passing object instances to untrusted code. Untrusted callers cannot be trusted to make such defensive copies. Consequently, providing copy functionality does not obviate the need for making defensive copies either of inputs received from , untrusted code or of outputs that are returned to , untrusted code.
Noncompliant Code Example
In this noncompliant code example, MutableClass
uses a mutable field date
of type Date
. Class Date
is also a mutable class. The example is noncompliant because the MutableClass
objects lack copy functionality.
Code Block | ||
---|---|---|
| ||
public final class MutableClass { private Date date; public MutableClass(Date d) { this.date = d; } public void setDate(Date d) { this.date = d; } public Date getDate() { return date; } } |
When a trusted caller passes an instance of MutableClass
to untrusted code, and the untrusted code modifies that instance (perhaps by incrementing the month or changing the timezone), the object's state of the object can be made inconsistent with respect to its previous state. Similar problems can arise in the presence of multiple threads, even in the absence of untrusted code.
Compliant Solution (Copy Constructor)
This compliant solution uses a copy constructor that initializes a MutableClass
instance when an argument of the same type (or subtype) is passed to it.:
Code Block | ||
---|---|---|
| ||
public final class MutableClass { // Copy Constructor constructor private final Date date; public MutableClass(MutableClass mc) { this.date = new Date(mc.date.getTime()); } public MutableClass(Date d) { this.date = new Date(d.getTime()); // Copy-in Make defensive copy } public Date getDate() { return (Date) date.clone(); // Copy and return } } |
This approach is useful when the instance fields are declared final. Callers request a copy by invoking the copy constructor with an existing MutableClass
instance as its argument.
Compliant Solution (Public Static Factory Method)
This compliant solution exports a public static factory method getInstance()
that creates and returns a copy of a given MutableClass
object instance. :
Code Block | ||
---|---|---|
| ||
class MutableClass { private final Date date; private MutableClass(Date d) { // Noninstantiable and nonsubclassable this.date = new Date(d.getTime()); // Copy-inMake defensive copy } public Date getDate() { return (Date) date.clone(); // Copy and return } public static MutableClass getInstance(MutableClass mc) { return new MutableClass(mc.getDate()); } } |
This approach is useful when the instance fields are declared final.
Compliant Solution (clone()
)
This compliant solution provides the needed copy functionality by declaring MutableClass
to be final, and by implementing the Cloneable
interface, and providing an Object.clone()
method that performs a deep copy of the object. :
Code Block | ||
---|---|---|
| ||
public final class MutableClass implements Cloneable { private Date date; public MutableClass(Date d) { this.date = new Date(d.getTime()); } public Date getDate() { return (Date) date.clone(); } public void setDate(Date d) { this.date = (Date) d.clone(); } public Object clone() throws CloneNotSupportedException { final MutableClass cloned = (MutableClass) super.clone(); cloned.date = (Date) date.clone(); // manuallyManually copy mutable Date object return cloned; } } |
Note that the {{ Wiki Markup clone()
}} method must manually clone the {{Date
}} object. This step is usually unnecessary when the object contains only primitive fields or fields that refer to immutable objects. However, when the fields contain data such as unique identifiers or object creation times, the {{clone()
}} method must calculate and assign appropriate new values for such fields \ [[Bloch 2008|AA. Bibliography#Bloch 08]\].
Mutable classes that define a clone()
method must be declared final
. This ensures that to ensure that untrusted code cannot declare a subclass that overrides the clone()
method so that it supplies to create a spurious instance. The clone()
method should copy all internal mutable state as necessary — in necessary—in this compliant example, the Date
object.
When untrusted code can call accessor methods passing mutable arguments, create defensive copies of the arguments before they are stored in any instance fields . See guideline FIO00(see OBJ06-J. Defensively copy mutable inputs and mutable internal components for additional information). When retrieving internal mutable state, make a defensive copy of that state before returning it to untrusted code . See guideline OBJ09(see OBJ05-J. Defensively copy Do not return references to private mutable class members before returning their references for additional information).
Defensive copies are would be unnecessary if untrusted code always invokes invoked an object's clone()
method on mutable state received from mutable classes and then operated only on the cloned copy. Unfortunately, untrusted code has little incentive to do so, and malicious code has every incentive to misbehave. This compliant solution both provides a clone()
method to trusted code and also guarantees that the state of the object cannot be compromised when the accessor methods are called directly from untrusted code.
Compliant Solution (clone()
with
...
Final Members)
When a mutable class's instance fields are declared final and lack accessible copy methods, provide a clone()
method, as shown in this compliant solution. :
Code Block | ||
---|---|---|
| ||
public final class MutableClass implements Cloneable { private final Date date; // final field public MutableClass(Date d) { this.date = new Date(d.getTime()); // Copy copy-in } public Date getDate() { return (Date) date.clone(); // copyCopy and return } public Object clone() throws CloneNotSupportedException { Date d = (Date) date.clone(); MutableClass cloned = new MutableClass(d); return cloned; } } |
Callers can use the {{ Wiki Markup clone()
}} method to obtain an instance of such a mutable class. The {{clone()
}} method must create a new instance of the {{ final }} member class and copy the original state to it. The new instance is necessary because no accessible copy method may be available in the member class. If the member class evolves in the future, it is critical to include the new state in the manual copy. Finally, the {{clone()}} method must create and return a new instance of the enclosing class ({{MutableClass}}) using the newly created member instance ({{d}}) \[[SCG 2007|AA. Bibliography#SCG 07]\]. because there might not be an accessible copy method available in the member class. If the member class evolves in the future, it is critical to include the new state in the manual copy. Finally, the clone()
method must create and return a new instance of the enclosing class (MutableClass
) using the newly created member instance (d
) [SCG 2009].
Mutable classes that define a clone()
method must be declared final.
Compliant Solution (Unmodifiable Date Wrapper)
If cloning or copying a mutable object is infeasible or expensive, one alternative is to create an immutable view class. This class overrides mutable methods to throw an exception, protecting the mutable class.
Code Block | ||
---|---|---|
| ||
class UnmodifiableDateView extends Date { private Date date; public UnmodifiableDateView(Date date) { this.date = date; } public void setTime(long date) { throw new UnsupportedOperationException(); } // Override all other mutator methods to throw UnsupportedOperationException } public final class MutableClass { private Date date; public MutableClass(Date d) { this.date = d; } public void setDate(Date d) { this.date = (Date) d.clone(); } public UnmodifiableDateView getDate() { return new UnmodifiableDateView(date); } } |
Exceptions
OBJ08OBJ04-J-EX0: Sensitive classes should not be cloneable, as per guideline OBJ03 OBJ07-J. Sensitive classes must not let themselves be copied.
Risk Assessment
Creating a mutable class without without providing copy functionality may can result in the data of its instance becoming corrupted when the instance is passed to untrusted code.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|
OBJ04-J |
Low |
Likely |
Medium | P6 | L2 |
Automated Detection
Sound automated detection appears to be is infeasible in the general case. Heuristic approaches may be useful.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Bibliography
Wiki Markup |
---|
\[[API 2006|AA. Bibliography#API 06]\] [method clone()|http://java.sun.com/javase/6/docs/api/java/lang/Object.html#clone()]
\[[Bloch 2008|AA. Bibliography#Bloch 08]\] Item 39: Make defensive copies when needed and Item 11: Override clone judiciously
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 374|http://cwe.mitre.org/data/definitions/374.html] "Mutable Objects Passed by Reference", [CWE ID 375|http://cwe.mitre.org/data/definitions/375.html] "Passing Mutable Objects to an Untrusted Method"\[[Security 2006|AA. Bibliography#Security 06]\]
\[[SCG 2007|AA. Bibliography#SCG 07]\] Guideline 2-2 Support copy functionality for a mutable class
\[[SCG 2009|AA. Bibliography#SCG 09]\] Guideline 2-3 Support copy functionality for a mutable class |
could be useful.
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
CodeSonar | 4.2 | FB.MALICIOUS_CODE.EI_EXPOSE_REP FB.MALICIOUS_CODE.EI_EXPOSE_REP2 | May expose internal representation by returning reference to mutable object May expose internal representation by incorporating reference to mutable object | ||||||
Coverity | 7.5 | FB.EI_EXPOSE_REP2 | Implemented | ||||||
Parasoft Jtest |
| CERT.OBJ04.CLONE CERT.OBJ04.CPCL CERT.OBJ04.MPT CERT.OBJ04.SMO CERT.OBJ04.MUCOP | Make your 'clone()' method "final" for security Enforce returning a defensive copy in 'clone()' methods Do not pass user-given mutable objects directly to certain types Do not store user-given mutable objects directly into variables Provide mutable classes with copy functionality |
Related Guidelines
CWE-374, Passing Mutable Objects to an Untrusted Method | |
Guideline 6-4 / MUTABLE-4: Support copy functionality for a mutable class |
Bibliography
[API 2014] | |
Item 39, "Make Defensive Copies When Needed" | |
[Security 2006] |
...
OBJ07-J. Understand how a superclass can affect a subclass 04. Object Orientation (OBJ) OBJ09-J. Defensively copy private mutable class members before returning their references