1899
The following example shows a basic user account class that includes member variables for the
username and password as well as a public constructor for the class and a public method to
authorize access to the user account.
Example Language: C++ (Bad)
#define MAX_PASSWORD_LENGTH 15
#define MAX_USERNAME_LENGTH 15
class UserAccount
{
public:
UserAccount(char *username, char *password)
{
if ((strlen(username) > MAX_USERNAME_LENGTH) ||
(strlen(password) > MAX_PASSWORD_LENGTH)) {
ExitError("Invalid username or password");
}
strcpy(this->username, username);
strcpy(this->password, password);
}
int authorizeAccess(char *username, char *password)
{
if ((strlen(username) > MAX_USERNAME_LENGTH) ||
(strlen(password) > MAX_PASSWORD_LENGTH)) {
ExitError("Invalid username or password");
}
// if the username and password in the input parameters are equal to
// the username and password of this account class then authorize access
if (strcmp(this->username, username) ||
strcmp(this->password, password))
return 0;
// otherwise do not authorize access
else
return 1;
}
char username[MAX_USERNAME_LENGTH+1];
char password[MAX_PASSWORD_LENGTH+1];
};
However, the member variables username and password are declared public and therefore will
allow access and changes to the member variables to anyone with access to the object. These
member variables should be declared private as shown below to prevent unauthorized access and
changes.
Example Language: C++ (Good)
class UserAccount
{
public:
...
private:
char username[MAX_USERNAME_LENGTH+1];
char password[MAX_PASSWORD_LENGTH+1];
};
Observed Examples
Reference Description
CVE-2010-3860 variables declared public allow remote read of system properties such as user
name and home directory.
https://www.cve.org/CVERecord?id=CVE-2010-3860
MemberOf Relationships
CWE Version 4.14
CWE-1062: Parent Class with References to Child Class
CWE-1062: Parent Class with References to Child Class