7PK - Encapsulation

Opis

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

Wpisy w tej grupie

• CWE-486 Comparison of Classes by Name
• CWE-488 Exposure of Data Element to Wrong Session
• CWE-489 Active Debug Code
• CWE-491 Public cloneable() Method Without Final ('Object Hijack')
• CWE-492 Use of Inner Class Containing Sensitive Data
• CWE-493 Critical Public Variable Without Final Modifier
• CWE-495 Private Data Structure Returned From A Public Method
• CWE-496 Public Data Assigned to Private Array-Typed Field
• CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
• CWE-501 Trust Boundary Violation

Uwagi

The "encapsulation" term is used in multiple ways. Within some security sources, the term is used to describe the establishment of boundaries between different control spheres. Within general computing circles, it is more about hiding implementation details and maintainability than security. Even within the security usage, there is also a question of whether "encapsulation" encompasses the entire range of security problems.

Źródła