Methods return values to signify failure or success, at other times, to update the caller's objects or fields. Security risks can arise if return values are simply ignored or if suitable action is not taken on their receipt.
Non-Compliant Code Example
This non-compliant code example ignores the return value while making use of the String.replace method. As a result, the original string is not updated even though it seems otherwise.
public class Ignore {
public static void main(String[] args) {
String original = "insecure";
original.replace( 'i', '9' );
System.out.println (original);
}
}
Compliant Solution
The compliant solution correctly updates the original string object by assigning to it the return value.
public class Ignore {
public static void main(String[] args) {
String original = "insecure";
original = original.replace( 'i', '9' );
System.out.println (original);
}
}
References
Canadian Mind Products Java & Internet Glossary by Roedy Green "String.replace" http://mindprod.com/jgloss/gotchas.html
API String.replace http://java.sun.com/j2se/1.4.2/docs/api/java/lang/String.html