The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
N/A
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
Intro: Here, a public method in a Java class returns a reference to a private array. Given that arrays in Java are mutable, any modifications made to the returned reference would be reflected in the original private array.
private String[] colors; public String[] getColors() { return colors; }Intro: In this example, the Color class defines functions that return non-const references to private members (an array type and an integer type), which are then arbitrarily altered from outside the control of the class.
class Color { private: int[2] colorArray; int colorValue; public: Color () : colorArray { 1, 2 }, colorValue (3) { }; int[2] & fa () { return colorArray; } // return reference to private array int & fv () { return colorValue; } // return reference to private integer }; int main () { Color c; c.fa () [1] = 42; // modifies private array element c.fv () = 42; // modifies private int return 0; }