CWE-496: Public Data Assigned to Private Array-Typed Field
Public Data Assigned to Private Array-Typed Field
Weakness ID: 496 (Weakness Variant)
Status: Incomplete
Description
Description Summary
Assigning public data to a private array is equivalent to
giving public access to the array.
Time of Introduction
Implementation
Applicable Platforms
Languages
C
C++
Java
.NET
Demonstrative Examples
Example 1
In the example below, the setRoles() method assigns a
publically-controllable array to a private field, thus allowing the caller
to modify the private array directly by virtue of the fact that arrays in
Java are mutable.
(Bad Code)
Java
private String[] userRoles;
public void setUserRoles(String[] userRoles) {
this.userRoles = userRoles;
}
Potential Mitigations
Phase
Description
Do not allow objects to modify private members of a class.
Description
