Private Data Structure Returned From A Public Method

Opis

The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.

Skutki

• Integrity

  Modify Application Data

  The contents of the data structure can be modified from outside the intended scope.

Zapobieganie

• Implementation

  Declare the method private.

• Implementation

  Clone the member data and keep an unmodified version of the data private to the object.

• Implementation

  Use public setter methods that govern how a private member can be modified.

Słabość nadrzędna

• CWE-664 Improper Control of a Resource Through its Lifetime

Kiedy powstaje

• Implementation

Dotyczy

Object-Oriented, C, C++, Java, C#

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005