CWE-491: Public cloneable() Method Without Final ('Object Hijack')
Public cloneable() Method Without Final ('Object Hijack')
Weakness ID: 491 (Weakness Variant)
Status: Draft
Description
Description Summary
A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
Time of Introduction
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Integrity
Other
Technical Impact: Unexpected state; Varies by context
Demonstrative Examples
Example 1
In this example, a public class "BankAccount" implements the
cloneable() method which declares "Object clone(string
accountnumber)":
(Bad Code)
Example
Language: Java
public class BankAccount implements Cloneable{
public Object clone(String accountnumber) throws
CloneNotSupportedException
{
Object returnMe = new BankAccount(account number);
...
}
}
Example 2
In the example below, a clone() method is defined without being
declared final.
Description
