Note: Do not expose map. Entry to untrusted code map. entryset ()

MAP/hashmap is a common data structure in Java. Generally, we do this in applications by calling put to write data to the container or get to read data from the container. The map. entryset () method returns a set of key-value pairs, which is also recommended by JDK to traverse the map.

Set<Map.Entry<String, String>> allEntrys = maps.entrySet();for (Map.Entry<String, String> as : allEntrys){    String key = as.getKey();String value = as.getValue();}

However, we should not pass the returned results of map. entryset () to untrusted code. Why? Let's take a look at the following code:

Public static void main (string [] ARGs) throws exception {hashmap <string, string> maps = new hashmap <string, string> (); maps. put ("name", "Xiu"); maps. put ("Age", "25"); system. out. println (MAPS); // {age = 25, name = Xiu} set <map. entry <string, string> allentrys = maps. entryset (); map. entry <string, string> nameentry = NULL; For (map. entry <string, string> as: allentrys) {string key =. getkey (); If (key. equals ("name") {nameentry = as ;}// Delete entry allentrys. remove (nameentry); system. out. println (MAPS); // {age = 25 }}

Obviously, we The returned results of map. entryset () can be used to delete the key-value pairs stored in the original hashmap.. If we pass set <map. Entry <string, string> allentrys as function parameters to untrusted code, malicious code can delete the data stored in the original hashmap. Therefore, we should avoid passing set <map. Entry <string, string> as function parameters to prevent external code from maliciously or accidentally modifying the original data. Not all Java programmers know this hidden function, so pay attention to it to avoid programming errors.

Note: Do not expose map. Entry to untrusted code map. entryset ()