VNX-375: Returning a Mutable Object to an Untrusted Caller

Field	Value
Rule ID	VNX-375
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-375
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	returning-mutable-objects cwe-375
Source	internal/sast/rules/vnx-375.rego

Overview

VNX-375 maps to CWE-375: Returning a Mutable Object to an Untrusted Caller. It reports return field; or return this.field; in a public or protected method (one-line getters included) when the field is declared in the same file as an array or as List, ArrayList, LinkedList, Map, HashMap, TreeMap, LinkedHashMap, Set, HashSet, TreeSet, LinkedHashSet, Collection, Deque, Queue, Date, Calendar or StringBuilder.

Not reported: a returned copy or view (Collections.unmodifiableList(x), List.copyOf(x), new ArrayList<>(x), x.clone()), fields initialised with an immutable value (List.of, Set.of, Map.of, Collections.unmodifiable*, Collections.empty*, Immutable*, copyOf), immutable field types, private and package-private methods, a local variable or parameter that shadows the field, JPA/document entities and JAXB-bound classes (whose collection getters the framework requires to be live), test sources and comments.

A public method with an array return type that returns a private, non-empty array field is reported by VNX-495, the array form of this weakness, and not here, so the line is not reported twice. This rule keeps collections, Date, Calendar and StringBuilder, protected methods, and arrays VNX-495 does not judge (protected or public fields, empty-array initialisers).

Why This Matters

A getter that hands out the field itself lets every caller change the object’s internal state: clear a list the object relies on, overwrite a secret array, or move a stored date, all without the checks the object’s own methods would apply.

What Gets Flagged

private final List<Item> items = new ArrayList<>();
public List<Item> getItems() {
    return items;                               // FLAGGED
}

public Set<String> getFlags() { return flags; } // FLAGGED

public Date getExpires() {
    return this.expires;                        // FLAGGED
}

Not flagged: return Collections.unmodifiableList(items);, return secret.clone();, return new Date(expires.getTime());, a field initialised with List.of(...).

Remediation

1. Return an unmodifiable view or a copy: Collections.unmodifiableList(items), List.copyOf(items), array.clone().
2. Prefer immutable field types (java.time.Instant instead of Date).

References

• CWE-375: Returning a Mutable Object to an Untrusted Caller
• SEI CERT OBJ05-J: Do not return references to private mutable class members

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-375
// nosec vnx-375

Or record an ignore rule: vulnetix ignore add --rule vnx-375 --reason "...". See Suppressing findings.