CWE-495: Private Array-Typed Field Returned From A Public Method
Private Array-Typed Field Returned From A Public Method
Weakness ID: 495 (Weakness Variant)
Status: Draft
Description
Description Summary
The product has a method that is declared public, but returns a
reference to a private array, which could then be modified in unexpected
ways.
Time of Introduction
Implementation
Applicable Platforms
Languages
C
C++
Java
.NET
Demonstrative Examples
Example 1
Here, a public method in a Java class returns a reference to a
private array. Given that arrays in Java are mutable, any modifications made
to the returned reference would be reflected in the original private
array.
(Bad Code)
Java
private String[] colors;
public String[] getColors() {
return colors;
}
Potential Mitigations
Phase
Description
Declare the method private.
Clone the member data and keep an unmodified version of the data
private to the object.
Use public setter methods that govern how a member can be modified.
Description
