In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial object is overwritten in memory (potentially unintentionally to the API author). It was explained to me that this can be an unintended software security vulnerability and would be something detected during a manual code review.
Can someone explain in what fashion this vulnerability would be exploited? Would it be in using someone else's API that contains this vulnerability or would it be in exploiting an actual application containing this? Are there any examples (in the news perhaps) of this being done?
Here is how it functions, according to the text:
MainActivity.class:
public class MainActivity {
public static void main(String[] args) {
ToyClass anObject = new ToyClass("Mr. Cellophane", 0);
System.out.println(anObject);
System.out.println("Now we call changer with anObject as an argument");
ToyClass.changer(anObject);
System.out.println(anObject);
}
}
ToyClass
public class ToyClass {
private String name;
private int number;
public ToyClass(String initialName, int initialNumber) {
name = initialName;
number = initialNumber;
}
public ToyClass() {
name = "No name yet.";
number = 0;
}
public void set(String newName, int newNumber) {
name = newName;
number = newNumber;
}
public String toString() {
return (name +" " + number);
}
public static void changer(ToyClass aParameter) {
aParameter.name = "Hot Shot";
aParameter.number = 42;
}
public boolean equals(ToyClass otherObject) {
return ((name.equals(otherObject.name)&& (number == otherObject.number) ));
}
}
Console Output:
Mr. Cellophane 0
Now we call changer with anObject as an argument
Hot Shot 42
Edit: To explain the background a bit more. This example shows how in the JVM memory system two objects are at a different address while the stored parameter is in the same memory location, and is overwritten by the second method. This is the basis of the "vulnerability".
changer
being able to modify its parameter is expected behavior.