1191
Example Language: Java (Bad)
private String[] colors;
public String[] getColors() {
return colors;
}
Example 2:
In this example, the Color class defines functions that return non-const references to private
members (an array type and an integer type), which are then arbitrarily altered from outside the
control of the class.
Example Language: C++ (Bad)
class Color
{
private:
int[2] colorArray;
int colorValue;
public:
Color () : colorArray { 1, 2 }, colorValue (3) { };
int[2] & fa () { return colorArray; } // return reference to private array
int & fv () { return colorValue; } // return reference to private integer
};
int main ()
{
Color c;
c.fa () [1] = 42; // modifies private array element
c.fv () = 42; // modifies private int
return 0;
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 485 7PK - Encapsulation 700 2328
MemberOf 884 CWE Cross-section 884 2567
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Private Array-Typed Field Returned
From A Public Method
Software Fault Patterns SFP23 Exposed Data
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE Version 4.14
CWE-496: Public Data Assigned to Private Array-Typed Field
CWE-496: Public Data Assigned to Private Array-Typed Field