Summary
HashSetReferenceInfo.getReferences() returns the live backing ArrayList<String> directly. Callers can add, remove, or clear entries without going through addReference(). Because HashSetReferenceInfo objects are stored as values in the static HashMaps in ReferentialIntegrityUtil (e.g. contextReferencesCumulative, bundleReferenceMap, collectionReferenceMap), external mutation of a returned list corrupts shared static validation state silently.
Affected code
gov/nasa/pds/tools/util/HashSetReferenceInfo.java, getReferences() (~line 55):
public ArrayList<String> getReferences() {
return (this.references);
}Recommended fix
Change return type to List<String> and return Collections.unmodifiableList(this.references). Mutation should only occur through addReference().
Related
Identified during immutability/synchronization audit triggered by PR #1607 review feedback.
🤖 Generated with Claude Code
Summary
HashSetReferenceInfo.getReferences()returns the live backingArrayList<String>directly. Callers can add, remove, or clear entries without going throughaddReference(). BecauseHashSetReferenceInfoobjects are stored as values in the staticHashMaps inReferentialIntegrityUtil(e.g.contextReferencesCumulative,bundleReferenceMap,collectionReferenceMap), external mutation of a returned list corrupts shared static validation state silently.Affected code
gov/nasa/pds/tools/util/HashSetReferenceInfo.java,getReferences()(~line 55):Recommended fix
Change return type to
List<String>and returnCollections.unmodifiableList(this.references). Mutation should only occur throughaddReference().Related
Identified during immutability/synchronization audit triggered by PR #1607 review feedback.
🤖 Generated with Claude Code