SonarQube - May Expose Internal Representation by storing an external mutable object

Viewed 796

the below code is giving an error when running through SonalQube for code Vulnerability.

public class Myclass{

String[] text;

public MyClass(String [] texts){
this.texts = texts;
}
}

The above code is throwing vulnerability error: May Expose Internal Representation by storing an external mutable object

1 Answers

As already mentioned in the comments, arrays are passed by Reference in Java (as all complex Objects). This means there is the oportiunity to pass a valid Sting[] to your class and after you checked it and stored it, the caller changes the content of the array to what ever he wants.

So if you want to close thie vulnerabilitity you need to store the array like this:

public class SaveArrayContainer {

public String[] data;

    public SaveArrayContainer(String[] array) {
        data = Arrays.copyOf(array, array.length);
    }
}
Related