CWE-496: Public Data Assigned to Private Array-Typed Field

Description

Assigning public data to a private array is equivalent to giving public access to the array.

Submission Date :

July 19, 2006, midnight

Modification Date :

2023-06-29 00:00:00+00:00

Organization :

MITRE

Example Vulnerable Codes

Example - 1

In the example below, the setRoles() method assigns a publically-controllable array to a private field, thus allowing the caller to modify the private array directly by virtue of the fact that arrays in Java are mutable.


this.userRoles = userRoles;private String[] userRoles;public void setUserRoles(String[] userRoles) {}

Related Weaknesses

This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.

CWE-664: Improper Control of a Resource Through its Lifetime

Go to

Visit http://cwe.mitre.org/ for more details.