Public cloneable() Method Without Final ('Object Hijack')

Opis

A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.

Skutki

• Integrity, Other

  Unexpected State; Varies by Context

Zapobieganie

• Implementation

  Make the cloneable() method final.

Słabość nadrzędna

• CWE-668 Exposure of Resource to Wrong Sphere

Kiedy powstaje

• Implementation

Dotyczy

Java

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005
2. OWASP , Attack Category : Mobile code: object hijack — OWASP