...
Exposing buffers created using the wrap(), duplicate(), array(), slice(), or subsequence() methods may allow an untrusted caller to alter the contents of the original data.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
FIO05-J | Medium | Likely | No | LowNo | P18P6 | L1L2 |
Automated Detection
Sound automated detection of this vulnerability is not feasible. Heuristic approaches may be useful.
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft Jtest |
| CERT.FIO05.BUFEXP | Do not expose data wrapped by a buffer to untrusted code | ||||||
| SpotBugs |
| MS_EXPOSE_BUF | Implemented (since 4.3.0) |
Bibliography
[API 2014] | |
Section 2.3 "Duplicating Buffers" |
...