CWE-491: Public cloneable() Method Without Final ('Object Hijack')
Public cloneable() Method Without Final ('Object Hijack')
Weakness ID: 491 (Weakness Variant)
Status: Draft
Description
Description Summary
A class has a cloneable() method that is not declared final,
which allows an object to be created without calling the constructor. This can
cause the object to be in an unexpected state.
Time of Introduction
Implementation
Applicable Platforms
Languages
Java
Demonstrative Examples
Example 1
In this example, a public class "BankAccount" implements the
cloneable() method which declares "Object clone(string
accountnumber)":
(Bad Code)
Java
public class BankAccount implements Cloneable{
public Object clone(String accountnumber) throws
CloneNotSupportedException
{
Object returnMe = new BankAccount(account number);
...
}
}
Example 2
In the example below, a clone() method is defined without being
declared final.
Description
