Public Data Assigned to Private Array-Typed Field

Opis

Assigning public data to a private array is equivalent to giving public access to the array.

Skutki

• Integrity

  Modify Application Data

  The contents of the array can be modified from outside the intended scope.

Zapobieganie

• Implementation

  Do not allow objects to modify private members of a class.

Słabość nadrzędna

• CWE-664 Improper Control of a Resource Through its Lifetime

Kiedy powstaje

• Implementation

Dotyczy

Object-Oriented, C, C++, Java, C#

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005