CWE-495
Private Data Structure Returned From A Public Method
AI Translation Available
The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
Status
draft
Abstraction
variant
Affected Platforms
C
C#
C++
Java
Object-Oriented
Technical Details
AI Translation
Common Consequences
integrity
Impacts
modify application data
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
Descriptions:
•
Clone the member data and keep an unmodified version of the data private to the object.
•
Declare the method private.
•
Use public setter methods that govern how a private member can be modified.