Referring to this CWE-496, it mentions that because of the application assigning public data to a private array it is equivalent to giving public access to the array.
This is not clear to me because usually before you can use the object, we must declare the object. For example:
User user = new User();
I am going to make two assumptions, and correct me if I am wrong.
new Object()will create different instance
- Inside User object, there is a private array
userRolesand a public setter named
My question is, since the object will declare new instances every time, how does the situation defined in CWE happen?
How come the
user.setUserRoles() in a second request will overwrite the values of the
userRoles variable in first request or the values of
userRoles variable in other pages?