...
Failing to create a copy of a mutable input may result in a TOCTOU vulnerability or expose internal mutable components to untrusted code.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
OBJ06-J | Medium | Probable | No | NoHigh | P4 | L3 |
Automated Detection
| Tool | Version | Checker | Description | CodeSonar | |||||
|---|---|---|---|---|---|---|---|---|---|
| Include Page | CodeSonar_V | CodeSonar_V | PMD.Security-Code-Guidelines.ArrayIsStoredDirectlyArray is stored directly May expose internal static state by storing a mutable object into a static field | ||||||
| Parasoft Jtest |
| SECURITYCERT.EABOBJ06.CPCL SECURITYCERT.OBJ06.EAB.MPT SECURITYCERT.EABOBJ06.SMO OOPCERT.OBJ06.MUCOP | Enforce returning a defensive copy in 'clone()' methods Do not pass user-given mutable objects directly to certain types Do not store user-given mutable objects directly into variables Provide mutable classes with copy functionality | ||||||
| SonarQube |
| S2384 | Mutable members should not be stored or returned directly Implemented for Arrays, Collections and Dates. |
Related Vulnerabilities
CVE-2012-0507 describes an exploit that managed to bypass Java's applet security sandbox and run malicious code on a remote user's machine. The exploit created a data structure that is normally impossible to create in Java but was built using deserialization, and the deserialization process did not perform defensive copies of the deserialized data. See the code examples in SER07-J. Do not use the default serialized form for classes with implementation-defined invariants for more information.
...