Java 恶意代码漏洞 - 可能通过合并对可变对象的引用来暴露内部表示
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/18954873/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Malicious code vulnerability - May expose internal representation by incorporating reference to mutable object
提问by Imesh Chandrasiri
I have the following code in my dto class.
我的 dto 类中有以下代码。
public void setBillDate(Date billDate) {
this.billDate = billDate;
}
And I get an error in sonar stated as such and I'm not sure what I'm doing wrong here.
我在声纳中得到了一个错误，我不确定我在这里做错了什么。
Malicious code vulnerability - May expose internal representation by incorporating reference to mutable object
The class is a dto and the method is automatically created setter method. What am I doing wrong here. if anyone could explain. it would be a great help.
该类是一个 dto 并且该方法是自动创建的 setter 方法。我在这里做错了什么。如果有人可以解释。这将是一个很大的帮助。
采纳答案by sanbhat
Dateis mutable
Date是可变的
Using that setter, someone can modify the date instance from outside unintentionally
使用该 setter，有人可以无意地从外部修改日期实例
Consider this
考虑这个
class MyClass {
private Date billDate;
public void setBillDate(Date billDate) {
this.billDate = billDate;
}
}
now some one can set it
现在有人可以设置它
MyClass m = new MyClass();
Date dateToBeSet = new Date();
m.setBillDate(dateToBeSet); //The actual dateToBeSet is set to m
dateToBeSet.setYear(...);
//^^^^^^^^ Un-intentional modification to dateToBeSet, will also modify the m's billDate
To avoid this, you may want to Deep-copybefore setting
为避免这种情况，您可能需要在设置之前进行Deep-copy
public void setBillDate(Date billDate) {
this.billDate = new Date(billDate.getTime());
}
回答by isnot2bad
Date is not immutable, i.e. your billDate can be changed after it has been set on your DTO object. Or, in code:
日期不是一成不变的，即您的 billDate 在您的 DTO 对象上设置后可以更改。或者，在代码中：
Date billDate = new Date();
dto.setBillDate(billDate);
billDate.setYear(1990);
// now, dto.getBillDate().getYear() == 1990
You can make your setter more secure:
你可以让你的 setter 更安全：
public void setBillDate(Date billDate) {
this.billDate = (Date)billDate.clone();
}
回答by Narendra Pathai
Dateis mutable
Date是可变的
and you are not creatinga copy ofDatethat came in to you are parameter. So if the client code will change the value of the Dateobject, it will affect your class too.
并且您没有创建传入Date您的参数的副本。所以如果客户端代码会改变Date对象的值，它也会影响你的类。
Solution is to create a copy of Date
解决方案是创建一个副本 Date
public setBillDate(Date billDate){
this.billDate = new Date(billDate.getTime());
}
回答by m.bemowski
I wonder why none of the solutions takes null into consideration. A general, null-safe solution should look like this:
我想知道为什么没有一个解决方案考虑 null 。通用的空安全解决方案应如下所示：
public void setBillDate(Date billDate) {
this.billDate = billDate != null ? new Date(billDate.getTime()) : null;
}
回答by ashish p
Consider using a clone as well. Don't forget null check.
也可以考虑使用克隆。不要忘记空检查。
public void setBillDate(Date billDate) {
this.billDate = billDate == null ? null : billDate.clone();
}
回答by Stéphane Essayie
Top answer number 37 is not the correct answer : nobody cares about NullPointerExceptions???
最佳答案 37 不是正确答案：没人关心 NullPointerExceptions ？？？
You should try this instead :
你应该试试这个：
public void setBillDate(Date billDate) {
this.billDate = billDate == null ? billDate : new Date(billDate.getTime());
}
回答by Nicolas Henneaux
In addition to the existing answers, I propose a new version based on Optionalclass from Java 8.
除了现有的答案之外，我还提出了一个基于OptionalJava 8 类的新版本。
public void setBillDate(Date billDate) {
this.billDate = Optional
.ofNullable(billDate)
.map(Date::getTime)
.map(Date::new)
.orElse(null);
}
回答by Akshay Lokur
A counter argument can be, why one would one unintentionallymodify the date? If client sets the value and then modifies it, then our code should reflect it, isn't it? If not then is it not confusing?
一个反驳可以是，为什么人们会无意中修改日期？如果客户端设置值然后修改它，那么我们的代码应该反映它，不是吗？如果没有，那不是令人困惑吗？
I prefer to just ignore this FindBugs warning.
我更喜欢忽略这个 FindBugs 警告。
In case if you want to do that, just add following Maven dependencies in your pom.xml:
如果您想这样做，只需在您的 Maven 依赖项中添加以下 Maven 依赖项pom.xml：
<!-- Findbugs -->
<dependency>
<groupId>com.google.code.findbugs</groupId>
<artifactId>annotations</artifactId>
<version>3.0.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>com.google.code.findbugs</groupId>
<artifactId>annotations</artifactId>
<version>3.0.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>com.google.code.findbugs</groupId>
<artifactId>jsr305</artifactId>
<version>3.0.1</version>
<scope>provided</scope>
</dependency>
and then these annotations at class or member field level in your POJO:
然后在 POJO 中的类或成员字段级别添加这些注释：
@SuppressFBWarnings(value = { "EI_EXPOSE_REP", "EI_EXPOSE_REP2" }, justification = "I prefer to suppress these FindBugs warnings")
Cheers
干杯
Akshay
阿克谢
