MALICIOUS_CODE EI_EXPOSE_REP Medium

Admin 1
Viewed 23888

I run findbugs against all of my code and only tackle the top stuff. I finally got the top stuff resolved and now am looking at the details. I have a simple entity, say a user:

public class User implements Serializable
{
    protected Date birthDate;

    public Date getBirthDate()
    {return(birthDate);}

    public void setBirthDate(final Date birthDate)
    {this.birthDate = birthDate;}
}

This class is incomplete, so don't harp me about it missing the serialVersionUID and other standard stuff, I am just concerned with the birthDate security hole.

Now, according to the findbugs report, since I am returning a reference to a mutable object, that is a potential security risk. In practice though, how much does that really matter?

http://findbugs.sourceforge.net/bugDescriptions.html#EI_EXPOSE_REP

I suppose I still don't really see what the problem is here in this case. Should I pass in a long and set the date from that?

Walter

findbugs security java
5 Answers

I'd prefer to store Date as Long in EpochTime format and use that for persisting across my application layers. That does not need any extra overriding of Lombok getters. Finally while providing the response, I can have an util function which will convert the epoch timestamp to a date and then return it as a string. May be do something like below ::

private String Epoch_to_ISO8601(Long savedTimeStamp) {
Date passedDate = new Date(savedTimeStamp);
String ISO8601_date =
    DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ssX")
        .withZone(ZoneOffset.UTC)
        .format(passedDate.toInstant());
return ISO8601_date;

}

user_56709390
Related