The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
Declare the method private.
Clone the member data and keep an unmodified version of the data private to the object.
Use public setter methods that govern how a private member can be modified.
Our security experts can help you identify and remediate CWE-495 vulnerabilities in your codebase.
Get Security Assessment