Page History

CERT C++ Secure Coding Standard

"OOP35-CPP. Do not return references to private data."

MITRE CWE

CWE ID 375, "Returning a Mutable Object to an Untrusted Caller"

Secure Coding Guidelines, V 2.0 SCG 2007

Guideline 2-1 Create a copy of mutable inputs and outputs

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="731dc97ff21494cb-ba4c0934-442e415c-8d35a262-e7c26ef130876af35e32b7e5"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

[method clone()

http://java.sun.com/javase/6/docs/api/java/lang/Object.html#clone()]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="88ea9793c9d0f20a-cc644ca5-4de943bd-a773aa7c-93d76018097e6c1b98ae3ac6"><ac:plain-text-body><![CDATA[

[[Bloch 2008

AA. Bibliography#Bloch 08]]

Item 39: Make defensive copies when needed

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="ef0c588f7984110a-351e07d3-47fa4be3-b2419df4-806db696bed3319f43d3ea3b"><ac:plain-text-body><![CDATA[

[[Goetz 2006

AA. Bibliography#Goetz 06]]

3.2. Publication and Escape: Allowing Internal Mutable State to Escape

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0f744731a78633a4-755cd2f0-42bf4411-a7419566-676ac09c1905d2f13ca0ec1e"><ac:plain-text-body><![CDATA[

[[Gong 2003

AA. Bibliography#Gong 03]]

9.4 Private Object State and Object Immutability

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="187f6d3d3526ac08-c11f52e2-4ce34217-bf969fa1-189bf02ee2cdc0a2f394afc6"><ac:plain-text-body><![CDATA[

[[Haggar 2000

AA. Bibliography#Haggar 00]]

[Practical Java Praxis 64: Use clone for Immutable Objects When Passing or Receiving Object References to Mutable Objects

http://www.informit.com/articles/article.aspx?p=20530]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="839a3eca7e56cb79-151b390f-4e6b4715-a08392ca-c39c88a345cab1dfc48e058e"><ac:plain-text-body><![CDATA[

[[Security 2006

AA. Bibliography#Security 06]]

]]></ac:plain-text-body></ac:structured-macro>