CWE-375: Returning a Mutable Object to an Untrusted Caller
Returning a Mutable Object to an Untrusted Caller
Weakness ID: 375 (Weakness Base)
Status: Draft
Description
Description Summary
Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function, thereby putting the class in an undefined state.
Time of Introduction
Implementation
Applicable Platforms
Languages
C
C++
Java
.NET
Common Consequences
Scope
Effect
Access Control
Integrity
Technical Impact: Modify memory
Potentially data could be tampered with by another function which
should not have been tampered with.
Likelihood of Exploit
Medium
Demonstrative Examples
Example 1
(Bad Code)
Example Languages: C and C++
private: externalClass foo;
public: void doStuff() {
//..
//Modify foo
return foo;
}
(Bad Code)
Example
Language: Java
public class foo {
private externalClass bar = new externalClass();
public doStuff(...){
//..//Modify bar
return bar;
}
Potential Mitigations
Phase: Implementation
Pass in data which should not be altered as constant or
immutable.
Phase: Implementation
Clone all mutable data before returning references to it. This is the
preferred mitigation. This way, regardless of what changes are made to
the data, a valid copy is retained for use by the class.
Other Notes
In situations where functions return references to mutable data, it is
possible that this external code, which called the function, may make
changes to the data sent. If this data was not previously cloned, you will
be left with modified data which may, or may not, be valid in the context of
the class in question.
Description
