Malicious code vulnerability - May expose internal representation by returning reference to mutable object

Question

Hi I\'m getting the violation as below:

Malicious code vulnerability - May expose internal representation by returning reference to mutable object

Answer 1

As the error message states, you're returning internal state (chkBox is - most likely - part of the internal state of an object even though you're not showing its definition)

This can cause problems if you - for example - do

String[] box = obj.chkBox();
box[0] = null;

Since an array object, as all Java objects, is passed by reference, this will change the original array stored inside your object as well.

What you most likely want to do to fix this is a simple

return (String[])chkBox.clone();

which returns a copy of the array instead of the actual array.