1174
CWE-491: Public cloneable() Method Without Final ('Object Hijack')
Weakness ID : 491
Structure : Simple
Abstraction : Variant
Description
A class has a cloneable() method that is not declared final, which allows an object to be created
without calling the constructor. This can cause the object to be in an unexpected state.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Other
Unexpected State
Varies by Context
Potential Mitigations
Phase: Implementation
Make the cloneable() method final.
Demonstrative Examples
Example 1:
In this example, a public class "BankAccount" implements the cloneable() method which declares
"Object clone(string accountnumber)":
Example Language: Java (Bad)
public class BankAccount implements Cloneable{
public Object clone(String accountnumber) throws
CloneNotSupportedException
{
Object returnMe = new BankAccount(account number);
...
}
}
Example 2:
In the example below, a clone() method is defined without being declared final.
Example Language: Java (Bad)
protected Object clone() throws CloneNotSupportedException {
...
}
MemberOf Relationships
CWE Version 4.14
CWE-492: Use of Inner Class Containing Sensitive Data
CWE-492: Use of Inner Class Containing Sensitive Data