924
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Language : Java (Prevalence = Undetermined)
Language : C# (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Access Control
Integrity
Modify Memory
Potentially data could be tampered with by another
function which should not have been tampered with.
Potential Mitigations
Phase: Implementation
Declare returned data which should not be altered as constant or immutable.
Phase: Implementation
Clone all mutable data before returning references to it. This is the preferred mitigation. This way,
regardless of what changes are made to the data, a valid copy is retained for use by the class.
Demonstrative Examples
Example 1:
This class has a private list of patients, but provides a way to see the list :
Example Language: Java (Bad)
public class ClinicalTrial {
private PatientClass[] patientList = new PatientClass[50];
public getPatients(...){
return patientList;
}
}
While this code only means to allow reading of the patient list, the getPatients() method returns a
reference to the class's original patient list instead of a reference to a copy of the list. Any caller of
this method can arbitrarily modify the contents of the patient list even though it is a private member
of the class.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 849 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 6 - Object Orientation (OBJ)
844 2364
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1139 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 05. Object Orientation (OBJ)
1133 2446
MemberOf 1181 SEI CERT Perl Coding Standard - Guidelines 03.
Expressions (EXP)
1178 2466
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
CWE Version 4.14
CWE-377: Insecure Temporary File
CWE-377: Insecure Temporary File