CS.METHOD.RETURN.REF_MEMBER
Member variable with reference type returned in method.
Member function should not return reference type members unless constant
Vulnerability and risk
Returned objects may be modified, causing unintended behavior.
Mitigation and prevention
Review the design to see if the reference type member variable should be returned.
Vulnerable code example
Copy
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace kmcustom
{
class MyCls
{
public string _str = "abc";
public void setStr(string str)
{
_str = str;
}
public string getStr()
{
return _str;
}
}
class C16
{
private string str = "abc";
private String cstr = "abc";
private int number = 1;
private int[] int_array = new int[5];
private MyCls myCls = new MyCls();
public string getStr()
{
return str;//OK - string or String is immutable
}
public string getCStr()
{
return str;//OK - string or String is immutable
}
public int getNumber()
{
return number;//OK
}
public MyCls getMyCls()
{
return myCls;//NG
}
public int[] getIntArray()
{
for(int i = 0; i < int_array.Length; i++)
{
int_array[i] = 0;
}
return int_array;//NG
}
public void printIntArray()
{
for (int i = 0; i < int_array.Length; i++) {
Console.WriteLine("index:" + i + " value:" + int_array[i]);
}
}
}
}