{"@ID": "374", "@Name": "Passing Mutable Objects to an Untrusted Method", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Draft", "Description": "The product sends non-cloned mutable data as an argument to a method or function.", "Extended_Description": "The function or method that has been called can alter or delete the mutable data. This could violate assumptions that the calling function has made about its state. In situations where unknown code is called with references to mutable data, this external code could make changes to the data sent. If this data was not previously cloned, the modified data might not be valid in the context of execution.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "668", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": [{"@Class": "Object-Oriented", "@Prevalence": "Undetermined"}, {"@Name": "C", "@Prevalence": "Undetermined"}, {"@Name": "C++", "@Prevalence": "Undetermined"}, {"@Name": "Java", "@Prevalence": "Undetermined"}, {"@Name": "C#", "@Prevalence": "Undetermined"}]}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Likelihood_Of_Exploit": "Medium", "Common_Consequences": {"Consequence": {"Scope": "Integrity", "Impact": "Modify Memory", "Note": "Potentially data could be tampered with by another function which should not have been tampered with."}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Implementation", "Description": "Pass in data which should not be altered as constant or immutable."}, {"Phase": "Implementation", "Description": "Clone all mutable data before passing it into an external function . This is the preferred mitigation. This way, regardless of what changes are made to the data, a valid copy is retained for use by the class."}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"Intro_Text": "The following example demonstrates the weakness.", "Example_Code": {"@Nature": "Bad", "@Language": "C", "xhtml:div": {"xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null], "#text": "int foo;complexType bar;String baz;otherClass externalClass;"}, {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "#text": "externalClass.doOtherStuff(foo, bar, baz)"}, "#text": "void doStuff() {}"}], "xhtml:br": [null, null], "#text": "private:\n                     \n                     public:"}}, "Body_Text": "In this example, bar and baz will be passed by reference to doOtherStuff() which may change them."}, {"Intro_Text": "In the following Java example, the BookStore class manages the sale of books in a bookstore, this class includes the member objects for the bookstore inventory and sales database manager classes. The BookStore class includes a method for updating the sales database and inventory when a book is sold. This method retrieves a Book object from the bookstore inventory object using the supplied ISBN number for the book class, then calls a method for the sales object to update the sales information and then calls a method for the inventory object to update inventory for the BookStore.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:div": [{"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null], "xhtml:i": ["// constructor for BookStore", "// other BookStore methods"], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "this.inventory = new BookStoreInventory();this.sales = new SalesDBManager();..."}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null], "xhtml:i": ["// Get book object from inventory using ISBN", "// update sales information for book sold", "// update inventory"], "#text": "Book book = inventory.getBookWithISBN(bookISBN);\n                                 \n                                 sales.updateSalesInformation(book);\n                                 \n                                 inventory.updateInventory(book);"}}], "#text": "private BookStoreInventory inventory;private SalesDBManager sales;...\n                           \n                           public BookStore() {}public void updateSalesAndInventoryForBookSold(String bookISBN) {}\n                           \n                           ..."}}, {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "xhtml:i": "// Book object constructors and get/set methods", "#text": "private String title;private String author;private String isbn;\n                        \n                        ..."}], "xhtml:br": null, "#text": "public class BookStore {}public class Book {}"}}, {"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null], "xhtml:i": ["// Get book object from inventory using ISBN", "// Create copy of book object to make sure contents are not changed", "// update sales information for book sold", "// update inventory"], "#text": "Book book = inventory.getBookWithISBN(bookISBN);\n                           \n                           Book bookSold = (Book) book.clone();\n                           \n                           sales.updateSalesInformation(bookSold);\n                           \n                           inventory.updateInventory(book);"}}, "#text": "...public void updateSalesAndInventoryForBookSold(String bookISBN) {}..."}}], "Body_Text": ["However, in this example the Book object that is retrieved and passed to the method of the sales object could have its contents modified by the method. This could cause unexpected results when the book object is sent to the method for the inventory object to update the inventory.", "In the Java programming language arguments to methods are passed by value, however in the case of objects a reference to the object is passed by value to the method. When an object reference is passed as a method argument a copy of the object reference is made within the method and therefore both references point to the same object. This allows the contents of the object to be modified by the method that holds the copy of the object reference. [REF-374]", "In this case the contents of the Book object could be modified by the method of the sales object prior to the call to update the inventory.", "To prevent the contents of the Book object from being modified, a copy of the Book object should be made before the method call to the sales object. In the following example a copy of the Book object is made using the clone() method and the copy of the Book object is passed to the method of the sales object. This will prevent any changes being made to the original Book object."]}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "CLASP", "Entry_Name": "Passing mutable objects to an untrusted method"}, {"@Taxonomy_Name": "The CERT Oracle Secure Coding Standard for Java (2011)", "Entry_ID": "OBJ04-J", "Entry_Name": "Provide mutable classes with copy functionality to safely allow passing instances to untrusted code"}, {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP23", "Entry_Name": "Exposed Data"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-18"}, {"@External_Reference_ID": "REF-374"}, {"@External_Reference_ID": "REF-375"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CLASP", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-06-21", "Modification_Version": "1.9", "Modification_ReleaseDate": "2010-06-21", "Modification_Comment": "updated Name, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-12-13", "Modification_Version": "1.11", "Modification_ReleaseDate": "2010-12-13", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences, Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Weakness_Ordinalities"}], "Previous_Entry_Name": {"@Date": "2010-06-21", "#text": "Mutable Objects Passed by Reference"}}}