CWE-495: Private Array-Typed Field Returned From A Public Method
Private Array-Typed Field Returned From A Public Method
Weakness ID: 495 (Weakness Variant)
Status: Draft
Description
Description Summary
The product has a method that is declared public, but returns a reference to a private array, which could then be modified in unexpected ways.
Time of Introduction
Implementation
Applicable Platforms
Languages
C
C++
Java
.NET
Common Consequences
Scope
Effect
Integrity
Technical Impact: Modify application
data
Demonstrative Examples
Example 1
Here, a public method in a Java class returns a reference to a
private array. Given that arrays in Java are mutable, any modifications made
to the returned reference would be reflected in the original private
array.
(Bad Code)
Example
Language: Java
private String[] colors;
public String[] getColors() {
return colors;
}
Potential Mitigations
Declare the method private.
Clone the member data and keep an unmodified version of the data
private to the object.
Use public setter methods that govern how a member can be modified.
Description
