CWE-496, Public Data Assigned to Private Array-Typed Field, says that assigning public data to a private array is equivalent to giving public access to the array. MITRE lists object oriented code in C, C++, Java and C#.
It is the input side of CWE-495, which covers the same problem on the way out.
How it happens
A constructor or setter takes an array argument and stores it directly. The caller still holds a reference to the same array.
// Vulnerable: stores the caller's array
public class Keyring {
private final byte[] key;
public Keyring(byte[] key) {
this.key = key;
}
}
byte[] k = loadKey();
Keyring r = new Keyring(k);
k[0] = 0; // silently changes the key inside r
What an attacker gains
MITRE lists one consequence: the array contents can be modified from outside the intended scope, affecting integrity. The record has no observed CVEs.
How to find it
Static analysis can find some instances. In review, look for constructors and setters that assign an array parameter straight to a field.
How to fix it
MITRE says not to allow objects to modify private members of a class. For arrays, that means copying on the way in.
public Keyring(byte[] key) {
this.key = key.clone(); // private copy
}
Pair this with copying on the way out, as in CWE-495, so neither side shares the array.
Quick check
Why is a private field not enough?
Private limits who can name the field. The caller already holds a reference to the same array object, so it can change the contents at will.
