CWE-496 公开数据赋值给私有的数组类型数据域

Public Data Assigned to Private Array-Typed Field

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

Assigning public data to a private array is equivalent to giving public access to the array.

适用平台

Language: [{'cwe_Name': 'C', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'C++', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'Java', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'C#', 'cwe_Prevalence': 'Undetermined'}]

常见的影响

范围	影响	注释
Integrity	Modify Application Data	The contents of the array can be modified from outside the intended scope.

可能的缓解方案

Implementation

策略:

Do not allow objects to modify private members of a class.

示例代码

例

In the example below, the setRoles() method assigns a publically-controllable array to a private field, thus allowing the caller to modify the private array directly by virtue of the fact that arrays in Java are mutable.

bad Java

private String[] userRoles;
public void setUserRoles(String[] userRoles) {

this.userRoles = userRoles;

}

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
7 Pernicious Kingdoms			Public Data Assigned to Private Array-Typed Field
Software Fault Patterns	SFP25		Tainted input to variable

VULHUB ™