Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

parameter passing by reference is performant bug might be insecure. #5176

Open
soloturn opened this issue Nov 17, 2023 · 1 comment
Open
Labels
Status: Needs Discussion Requires help discussing a reported issue or provided PR Type: Improvement Request for or addition/enhancement of a feature

Comments

@soloturn
Copy link
Contributor

soloturn commented Nov 17, 2023

parameter passing by reference

on a number of locations in the code static code analysis tools like pmd warn that data structures passed are stored and returned directly. while java has no pointers, this behaviour is similar, passing by reference. so an outside actor can change the contents of the structure. such a parameter passing may be a security leak especially in public APIs. see for example here for an explanation

for games, this is more a performance feature than a security leak.

keywords:
MethodReturnsInternalArray, ArrayIsStoredDirectly,

Proposal

@jdrueckert wishes a more thorough discussion about the issue, and suggested to suppress the warning at the moment and link to this ticket, in a TODO.

@soloturn soloturn added Status: Needs Discussion Requires help discussing a reported issue or provided PR Type: Improvement Request for or addition/enhancement of a feature labels Nov 17, 2023
@jdrueckert
Copy link
Member

Associated Secure Code Guidelines: https://www.ing.iac.es//~docs/external/java/pmd/rules/sunsecure.html

While I agree that the code was likely written the way it was because the main focus was on performance, personally coming from a security point of view, I'm hesitant to just accept this as "likely not a problem in game development" without a proper criticality assessment of this security flaw - in particular as the respective PMD findings occurred in type handler code which is exposed enough to be of concern, especially in a multiplayer setup.

jdrueckert added a commit that referenced this issue Nov 18, 2023
* kotlin jps updated itself
* update spotbugs version to consume AsserThrows error fix (spotbugs/spotbugs#2667)
* parametrize logs
* make fields final
* remove unused logger
* suppress PMD.ArrayIsStoredDirectly and PMD.MethodReturnsInternalArray until proper security assessment (#5176)
* respect inner type last rule (https://stackoverflow.com/questions/25158939/what-motivation-is-behind-checkstyle-inner-type-last-rule)
* replace assertEquals with assertArrayEquals for arrays
* suppress warning for unused field in ObjectFieldMapTypeHandlerFactoryTest (Direct member access is not expected. TypeHandler factory dynamically loads type handlers on type handler creation based on member types of input class TypeInfo.)

Co-authored-by: jdrueckert <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Status: Needs Discussion Requires help discussing a reported issue or provided PR Type: Improvement Request for or addition/enhancement of a feature
Projects
Status: No status
Status: No status
Development

No branches or pull requests

2 participants