SV.CLONE.SUP

This error appears when class defines clone method which calls super.clone() but it does not implement Cloneable interface.

Vulnerability and risk

If object does not implement Cloneable Object.clone() method would throw an Exception, which is probably not the intended behavior in this case.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

If the intention was to throw an exception, define the following clone method:

 
public final Object clone() throws CloneNotSupportedException 
{ 
   throw CloneNotSupportedException(); 
}

If intention was to define a proper clone method, the class must implement a Cloneable interface.

Example 1

8  public class SV_CLONE_SUP_Sample_1 {
9      private String password;
10     protected SV_CLONE_SUP_Sample_1(String x) {
11         password = x;
12     }
13     protected String getPassword() {
14         return password;
15     }
16     protected final Object clone()
17             throws CloneNotSupportedException {
18         return super.clone();
19     }
20 }

SV.CLONE.SUP is reported for class declaration on line 18: Class 'com.klocwork.jdefects.checkers.ast.samples.SV_CLONE_SUP_Sample_1' implements 'clone' method but does not implement Cloneable, which makes Object clone implementation throw an exception

Security guidelines

• CWE-580: clone() Method Without super.clone()