May expose internal representation by incorporating reference to mutable object
分析
主要是针对Date类的get/set方法,涉及了深拷贝和浅拷贝的问题。
解决方法:
public Date getCreateDate() {
return (Date) createDate.clone();
}
public void setCreateDate(Date createDate) {
this.createDate = (Date) createDate.clone();
}
Write to static field from instance method
原因:在其他类对static属性进行直接修改
解决方法:将static属性设置为private或者protected形式,使用set/get方法进行修改和获取。
Field should be package protected
A mutable static field could be changed by malicious code or by accident. The field could be made package protected to avoid this vulnerability.
解决方法:将属性设置为private或者protected形式,使用set/get方法进行修改和获取。