...
Creating a mutable class without providing copy functionality can result in the data of its instance becoming corrupted when the instance is passed to untrusted code.
Rule | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
OBJ04-J | Low | Likely | No |
No |
P3 |
L3 |
Automated Detection
Sound automated detection is infeasible in the general case. Heuristic approaches could be useful.
Tool | Version | Checker | Description |
|---|
| Coverity |
| 7. |
| 5 | FB. |
EI_EXPOSE_ |
REP2 |
.EI_EXPOSE_ |
May expose internal representation by returning reference to mutable object
May expose internal representation by incorporating reference to mutable object
REP | Implemented | |||||||
| Klocwork |
| SV.EXPOSE.RET SV.EXPOSE.STORE |
FB.EI_EXPOSE_REP2
FB.EI_EXPOSE_REP
| Parasoft Jtest |
|
|
|
| CERT. |
| OBJ04.CLONE |
CERT. |
| OBJ04.CPCL |
CERT. |
| OBJ04.MPT |
CERT. |
| OBJ04.SMO |
CERT.OBJ04.MUCOP | Make your 'clone()' method "final" for security Enforce returning a defensive copy in 'clone()' methods Do not pass user-given mutable objects directly to certain types Do not store user-given mutable objects directly into variables Provide mutable classes with copy functionality |
Related Guidelines
CWE-374, Passing Mutable Objects to an Untrusted Method | |
Guideline 6-4 / MUTABLE-4: Support copy functionality for a mutable class |
Bibliography
[API 2014] | |
Item 39, "Make Defensive Copies When Needed" | |
| [Security 2006] |
...
...