...
This noncompliant code example complies with OBJ01-J. Limit accessibility of fields by declaring the array private. But, in declaring the array private, this code example violates OBJ05-J. Do not return references to private mutable class members.
Suppose that SomeType is immutable.
...
Having a public static final array is a potential security risk because the array elements may be modified by a client.
| Rule | Severity | Likelihood | Detectable | Remediation CostRepairable | Priority | Level |
|---|---|---|---|---|---|---|
OBJ13-J | Medium | Likely | Yes | NoLow | P18P12 | L1 |
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft Jtest |
| CERT.OBJ13.RMO | Avoid referencing mutable fields | ||||||
| SonarQube |
| ||||||||
| SpotBugs |
| MS_EXPOSE_REP | Implemented (since 4.3.0) |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
...