Travel safe this upcoming week. If You Got this error while youre compiling your code? Should you wish to do so, please emailFortifyTechSupport@hpe.com and reference support case#00278285 opened on Oct 10. FindBugs is sponsored by Fortify Software FindBugs is a popular analysis tool . C/C++. Request PDF | Tracking Null Checks in Open-Source Java Systems | It is widely acknowledged that null values should be avoided if possible or carefully used when necessary in Java code. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. The program can potentially dereference a null-pointer, thereby causing a segmentation fault. The purpose of this Release Notes document is to announce the release of the ES 5.14. . Closed. But, when you try to declare a reference type, something different happens. Private personal information may include a password, phone number, geographic location, personal messages, credit card number, etc. It essentially means that the object's reference variable is not pointing anywhere and refers to nothing or 'null'. Pointers are variables that store the memory address of an object, and a null pointer dereference occurs when you try to access an object . relevant defects identified by Prevent were related to potential null dereference. Fortify Null Dereference in Java; Chain Validation test; Apigee issue with PUT and POST operation; Query annotation not working with and / or operators; org.springframework.beans.factory.BeanDefinitionStoreException: Failed to process import candidates for configuration class Fortify: Null Dereference and Portability Flaw: Locale Dependent Comparison. Now, let us move to the solution for this error, How to Fix "int cannot be dereferenced" error? Primitive [byte, char, short, int, long, float, double, boolean]. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for . If foo is null when it is checked in the if statement, then a null dereference will occur, thereby causing a null-pointer exception. In the most recent project scanned, only 1 of 24 Null Dereference issues found was legitamite. Since it's not pointing to anything (because that's what null means), that's an error. If connection is null, it will still throw an exception. Fortify-Issue-300 Null Dereference issues #302. The program can potentially dereference a null-pointer, thereby raising a NullPointerException. Team Collaboration and Endpoint Management. If a question is poorly phrased then either ask for clarification, ignore it, or. The nature of simulating nature: A Q&A with IBM Quantum researcher Dr. Jamie We've added a "Necessary cookies only" option to the cookie consent popup. If Fortify SCA can be put into a pipeline, it can also be hooked to fix issues automatically (although care must be taken to avoid situations like the Debian OpenSSL PRNG vulnerability, which was not a vulnerability until a security-focused static code analyzer suggested a fix that ended up being the vulnerability). Network Operations Management (NNM and Network Automation). In this example, the variable x is an int and Java will initialize it to 0 for you. The bad news is that they do what you tell them to do." You can perform an explicit check for NULL for all pointers returned by functions that can return NULL, and when parameters are passed to the function. Perhaps it is possible to write a custom Control Flow rule that will track previously null pointers across passing to method calls and assignments? Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. about checking values between rows with dynamic table created using java script. As a counter-example, though, note that calling free() or delete on a NULL in C and C++ is guaranteed to be a no-op. Test every line of code and potential execution path. Free source code and tutorials for Software developers and Architects. 90 int npeV = npe.frugalCopy().getV(); 91 92 log("Called a method of an object returned by a method: " npeV); 93 94 if (npeV == 2) { 95 System.clearProperty("os.name"); 96 } 97 98 String os = System.getProperty("os.name"); 99 // Fortify catches a possible NPE where null signals absence of a 100 // resource, showing a Missing Check against Null finding. Convert a String to Character Array in Java. The project is a simple C# console application, with no reference whatsoever to ASP.NET libraries. $ c:/jdk8/bin/javac -cp lib/commons-lang3-3.7.jar -d build NPE.java$ java -cp 'lib/commons-lang3-3.7.jar;build' npe.NPE fooarg is foodangerousLength is 3protected length is 3StringUtils protected length is 3(as much dangerous) length is 3StringUtils protected (no thanks to Fortify tracking) length is 3Called a method of an object returned by a method: 1OS Windows 7 is supportedOS Windows 7 is supported$ sourceanalyzer -scan -cp lib/commons-lang3-3.7.jar NPE.java[error]: Your license does not allow access to Fortify SCA for Pythoncom.fortify.licensing.UnlicensedCapabilityException: Your license does not allow access to Fortify SCA for Python at com.fortify.licensing.Licensing.getCapabilityConfig(Licensing.java:120) ~[fortify-common-18.20.0.1071.jar:?] By clicking Post Your Answer, you agree to our terms of service, privacy policy and cookie policy. Note: Before moving to this, to fix the issue in Example 1 we can print, Well, it identifies hundreds of known code vulnerabilities, covers security standard and also make sure to address industry compliance regulations. Check the documentation for the Connection object of the type returned by the getConnection() factory method, and see if the methods rollback() and close() will even throw an exception. So mark them as Not an issue and move on. : Fortify: The method processMessage() in VET360InboundProcessService.java can crash the program by dereferencing a null pointer on line 197. Null dereference is a commonly occurring defect in Java programs, and many static-analysis tools identify such defects. To actually scan translated code for vulnerabilities, you must either: be a licensed Fortify SCA user. A null pointer dereference, on the other hand, is a specific type of null dereference that occurs when you try to access an object reference that has a null value in a programming language that uses pointers. If connection is null, it will still throw an exception. Demos (FindBugs, Fortify SCA) Integrating static analysis Wrap up. Most appsec missions are graded on fixing app vulns, not finding them. The issues include: "Buffer Overflows," "Cross-Site Scripting" attacks, "SQL Injection," and many others. How to use Slater Type Orbitals as a basis functions in matrix method correctly? Thanks for contributing an answer to Stack Overflow! In this noncompliant code example, input_str is copied into dynamically allocated memory referenced by c_str.If malloc() fails, it returns a null pointer that is assigned to c_str.When c_str is dereferenced in memcpy(), the program exhibits undefined behavior.. Additionally, if input_str is a null pointer, the call to strlen() dereferences a null Null Dereference C#, After using Fortify to analyze my code, Fortify show me a vulnerability which is " Null Dereference". Note that this code is also vulnerable to a buffer overflow . Our current plan is to remain open for https://t.co/IwbQgYoZUk, Nov 01, We love seeing this enthusiasm for structural pasteurization from realtors https://t.co/ihCVF4uUk3 https://t.co/3uMUV1VabD, Jul 28. If I had to guess, the tool you're using is complaining about our use of Math.random() but we don't rely on it being cryptographically secure. An API is a contract between a caller and a callee. Symantec security products include an extensive database of attack signatures. ][C:/DIR/npe][38F1CD7C547F94C73D421BDC0BA6B45B : low : System Information Leak : Internal : dataflow ]NPE.java(43) : ->PrintStream.println(0) NPE.java(102) : ->NPE.log(0) NPE.java(98) : <=> (os) NPE.java(98) : <- System.getProperty(return)[38F1CD7C547F94C73D421BDC0BA6B45C : low : System Information Leak : Internal : dataflow ]NPE.java(43) : ->PrintStream.println(0) NPE.java(111) : ->NPE.log(0) NPE.java(109) : <=> (os2) NPE.java(51) : return (s) NPE.java(109) : <->NPE.defaultIfEmpty(0->return) NPE.java(109) : <- System.getProperty(return)[B679BDBBFADB6AD00720E35440F876F7 : high : Null Dereference : controlflow ] NPE.java(57) : Assigned null : arg NPE.java(58) : Branch not taken: ((args.length) <= 0) NPE.java(77) : Dereferenced : arg[935183D4911A3F55EEA10E64B6BDC2F6 : low : Missing Check against Null : controlflow ] NPE.java(98) : start -> allocated : os = getProperty(?) (partial fix)) 1.0.5 (February 7, 2018) handle source files with any character encoding (issue 267) Scala 2.11.6 and 2.11.7 are now supported (issue 217) Fortify prioritizes and categorizes the findings so that we can address them immediately." The Java VM sets them so, as long as Java isn't corrupted, you're safe. The following function attempts to acquire a lock in order to perform . How Intuit democratizes AI development across teams through reusability. #icon5632:hover{color:;background:;} 180 Canada Larga Rd. When indirection operator (*) is used with the pointer variable, then it is known as dereferencing a pointer. In Dungeon World, is the Bard's Arcane Art subject to the same failure outcomes as other spells? You also had the guts to say "never check for null" (if null is invalid).Placing an assert() in every member function that dereferences a pointer is a compromise that will likely placate a lot of people, but even that feels like 'speculative paranoia' to me. fill_foo checks if the pointer has a value, not if the pointer has a valid value. Unchecked return value leads to resultant integer overflow and code execution. For Benchmark, we've seen it report it both ways. (and obviously if httpInputStream is different from null, to avoid a possible Null Dereference by invoking the close() method). But it seems that fortify is not considering these checks as a valid null check. I do not know why and how the Data Flow syntax differs from the Control Flow one. NULL pointer dereference erros are common in C/C++ languages. It is not uncommon for Java programmers to misunderstand read() and related methods that are part of many java.io classes. privacy statement. It's simply a check to make sure the variable is not null. This could allow the server to make the client crash due to the NULL pointer dereference Separate licenses are available for C/C++ analysis and Java analysis. This message takes into account the current system culture. #icon876:hover{color:;background:;} info@thermapure.com, Wishing everyone a peaceful and green holiday from here in Ventura! Dereference before null check (REVERSE_INULL) There may be a null pointer exception, or else the . For an attacker it provides an opportunity to stress the system in unexpected ways. Rule ID: B32F92AC-9605-0987-E73B-CCB28279AA24. IsNullOrEmpty is a convenience method that enables you to simultaneously test whether a String is Nothing or its value is Empty. How do I align things in the following tabular environment? An extremely nice thing which was discovered only by Coverity. Is Made In Chelsea Scripted, Successfully merging a pull request may close this issue. This release, developed in Java technology, contains ESM Phase 3 development and upgrade efforts. Connect and share knowledge within a single location that is structured and easy to search. On File delete, using java File delete method what could be the security issue? Dereferencing a null pointer An impossible checked cast . if (foo == null) { foo.setBar (val); . } Could someone advise here? However, since ES inherits the system use notification/warning banner from the VA Enterprise Identity and Access Management (IAM) Single Sign-On Internal (SSOi) infrastructure when a user initially establishes a session, ES 5.13 is updated to no longer . Fortify flags this for null dereference. For example: org.apache.commons.lang3.StringUtils.defaultIfEmpty() If you use any of the original input, you may still get the error. Network Operations Management (NNM and Network Automation). CiteSeerX - Document Details (Isaac Councill, Lee Giles, Pradeep Teregowda): Many analysis techniques have been proposed to determine when a potentially null value may be dereferenced. to fix over 7500 defects across 250 open source projects and 50 million lines of code. Chain: The return value of a function returning a pointer is not checked for success ( CWE-252) resulting in the later use of an uninitialized variable ( CWE-456) and a null pointer dereference ( CWE-476) CVE-2007-3798. By clicking Accept all cookies, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy. The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. i know which session objects are NULL when the page loads and so i am checking it that if its null . We are struggling with a large number of false positives from our scans and hoping for some it is a matter of configuration. It serves as a common language, a measuring stick for security tools, and as a baseline for weakness identification, mitigation, and prevention efforts. In this example, the variable x is an int and Java will initialize it to 0 for you. 1 solution Solution 1 Nothing. Jira will be down for Maintenance on June 6,2022 from 9.00 AM - 2.PM PT, Monday(4.00 PM - 9.00PM UTC, Monday) +1 for a very succinct answer that pretty much sums up the way I feel: "it depends." Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. 84 log("StringUtils protected (no thanks to Fortify tracking) length is " arg.length()); 85 86 NPE npe = new NPE(1); 87 88 // Fortify fails to catch a possible NPE when the null may come from a 89 // custom method such as frugalCopy(). NPD vulnerability can be exploited by hackers to maliciously crash a process to cause a denial of service or execute an arbitrary code under specific conditions. beyond that why are you scanning possible characters instead of just checking upper and lower limits. I want to pass an encrypted password to another program to decrypt, Tomcat application arbitrary file read exploitation. This message takes into account the current system culture. Teams. Why are Suriname, Belize, and Guinea-Bissau classified as "Small Island Developing States"? case " Null Dereference ": return 476; // Fortify reports weak randomness issues under Obsolete by ESAPI, rather than in // the Insecure Randomness category if it thinks you are using ESAPI. Our team struggles with the same thing. The call cr.getPassword() may return null value in the com.hazelcast.client.connection.nio.ClientConnectionManagerImpl.encodeAuthenticationRequest(boolean, SerializationService, ClientPrincipal) method. Learn more about Stack Overflow the company, and our products. Whenever we use the "return early" code pattern, Fortify is not able to understand it and raises a "possible null dereference" warning. Whenever we use the "return early" code pattern, Fortify is not able to understand it and raises a "possible null dereference" warning. This release, developed in Java technology, contains ESM Phase 4 development and upgrade efforts. pass = getPassword (); jadejaan over 5 years ago I am trying to validate SMTP header so that fortify can identified it as a fix. So one cannot do Primitive.something(). Fortify: Null Dereference (1 issue . However, its // behavior isn't consistent. JavaDereference before null check . As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. CODETOOLS-7900079 Fortify: Analize and fix "Code Correctness: Regular Expressions Denial of Service" issues. ; Updated: 29 Sep 2017 To translate Scala code for Fortify to scan, you must be a current Lightbend subscriber. Fortify source code analyzer is giving lot's of "Null Dereference" issues becausewe have used Apache Utils to ensure null check. Midwest Athletics Cheer, Fortify-Issue-300 Null Dereference issues. Thanks to both of you; that's much clearer now. If maybeNull is null, the conditional will resolve to false, and will not enter the block where maybeNull.OtherMember is accessed. . The most common quality bug identified was the null pointer dereference, which can cause programmes to crash, or worse, lead to data Null pointer in C. NULL pointer in C, An integer constant expression with the value 0, or such an expression cast to type void *, is called a null pointer constant. to your account. In C++, pointers are not guaranteed to be either NULL of have a valid value. */ } What I am trying to do is initialize ApplicanteeTO object with null, then check if it is under certain population type, populate it. When you assign the value of 10 on the second line, your value of 10 is written into the memory location referred to by x. . Check the documentation for the Connection object of the type returned by the getConnection() factory method, and see if the methods rollback() and close() will even throw an exception. #happyholidays2019 #earlyday https://t.co/CIUwaC3QFA, Dec 25, We think #rei has the right idea, and #blackfriday is a great day to #optoutside. The root cause of each defect is clearly explained, making it easy to fix bugs Integrated with However, one article [1] claims that the cost of a one year license is based on the number of lines of code, regardless of the number of users. I believe this particular behavior is a gap in the Fortify analyzer implementation, as all other static analysis tools seem to understand the code flow and will not complain about potential null references in this case. Investigate instances where Fortify has identified a null pointer as a potential security flaw. email is in use. Here is a POC The Optional class contains methods that can be used to make programs shorter and more intuitive [].. C#/VB.NET/ASP.NET. Why do academics stay as adjuncts for years rather than move around? Bangkok Bank Branch Code List, Please be sure to answer the question.Provide details and share your research! But I do see a problem in line 9: Thanks, you are correct, I meant line 9 and I see the error now. Null Dereference C/C++ C#/VB.NET/ASP.NET Java/JSP Abstract clones. Closed. Ventura CA 93001 Well occasionally send you account related emails. #icon8226:hover{color:;background:;} 800-366-2022 This agrees with Fortify's 81 // alleged lack of tracking method calls and assignments in its 82 // high-risk Null Dereference rule. Fortify found 2 "Null Dereference" issues. But what exactly does it mean to "dereference a null pointer"? How can we prove that the supernatural or paranormal doesn't exist? getAuth() should not return null.A method returning a List should per convention never return null but an empty List as default "empty" value.. private List getAuth(){ return new ArrayList<>(); } java.util.Collections.emptyList() should only be used, if you are sure that every caller of the method does not change the list (does not try to add any items), as this would fail on this . Calling equals() method on the int primitive, we encounter this error usually when we try to use the .equals() method instead of == to check the equality. Accessing or modifying a null objects field. We have, however, opened a support case with the following repro: Scanning this code with Visual Studio 2015 update 3 and HP Fortify plugin 17.10, two issues are found, both invalid: ASP.NET Bad Practices: Leftover Debug Code (Encapsulation, Structural): The class Program contains debug code, which can create unintended entry points in a deployed web application. There are at least three flavors of this problem: check-after-dereference, dereference-after-check, and dereference-after-store. at com.fortify.sca.Main$Sourceanalyzer.run(Main.java:527) [fortify-sca-18.20.1071.jar:? The program can potentially dereference a null-pointer, thereby raising a NullException. #channelislandsharbor #oxnard @ C https://t.co/ns1WvY7xHh, Nov 29, Happy Thanksgiving from all of us at ThermaPure! Description. Issue Links clones CODETOOLS-7900081 Fortify: Analize and fix "Null Dereference" issues Closed relates to CODETOOLS-7900046 Complete Fortify code updates Closed Activity All Comments Work Log History Activity If not, leave it as null. Dim str As String = Nothing If String.IsNullOrEmpty (str) Then MsgBox ("String is null") End If. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. But what exactly does it mean to "dereference a null pointer"? Difference Between FileInputStream and FileReader in Java, Introduction about the error with example. Liberalism Used In A Sentence, "We use Fortify's static analysis capabilities to analyze our source code as we develop new features or make enhancements. String fileString = new String(byteArr); String fileSHA256Hex = DigestUtils.sha256Hex(fileString); // use fileSHA256Hex to validate file. In Java there are two different variables are there: Since primitives are not objects so they actually do not have any member variables/ methods. The value is then dereferenced without a null check in ClientAuthenticationCodec.encodeRequest call: Because your release of resources is conditional on the state of a boolean variable and encased in another try block, the static analyzer must be deciding that rollback() and close() are not guaranteed to execute.. They are not only hard to identify but also complex to deal with. Fix : Analysis found that this is a false positive result; no code changes are required. CVE-2006-4447. Explanation Null-pointer errors are usually the result of one or more programmer assumptions being violated. ThermaPure has over 15 years of experience training individuals and organizations to use heat to remediate structures and kill pests. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') The program can dereference a null-pointer because it does not check the return value of a function that might return null. Is it correct to use "the" before "materials used in making buildings are"? EXP01-J-EX0: A method may dereference an object-typed parameter without guarantee that it is a valid object reference provided that the method documents that it (potentially) throws a NullPointerException, either via the throws clause of the method or Abstract. Whenever we use the "return early" code pattern, Fortify is not able to understand it and raises a "possible null dereference" warning. One may need to close Audit Workbench and reimport the project to see whether the vulnerability goes away from scan report. @MitchWheat Sure - but if fortify behaves like other analyzers, there may be a null check above this code which doesn't skip this code path if ddl is null. The opinions expressed above are the personal opinions of the authors, not of Micro Focus. We have these rule packs installed that seem to be relevant to the .Net, Name: Fortify Secure Coding Rules, Core, .NETVersion: 2017.3.0.0008ID: D57210E5-E762-4112-97DD-019E61D32D0ESKU: RUL13002, Version: 2017.3.0.0008ID: 557BCC56-CD42-43A7-B4FE-CDD00D58577ESKU: RUL13027Provides coverage of security relevant APIs in various extended and third-party .NET libraries including Log4Net(TM) and the Microsoft EnterpriseLibrary(TM). Sign in Find and fix defects in your Java, C/C++, C#, JavaScript, Ruby, or Python open source project for free. Initializes a new instance of the NullReferenceException class, setting the Message property of the new instance to a system-supplied message that describes the error, such as "The value 'null' was found where an instance of an object was required." We can fix this issue just by replacing the .equals() method with== so lets implement == symbol and try to compile our code. Issue Links. It has no particular knowledge of 83 // the Apache Commons null-checking method. CONNECT Software project. Fortify keeps track of the parts that came from the original input. Does it just mean failing to correctly check if a value is null? Agreed!!! In Java, a special null value can be assigned to an object reference. The Null dereference error was on the line of code sortName = lastName; not the call of the setter : fortify do not want you to conditionnally change the value of a variable that was set to null without doing so in all the branches. Even if you were to add input filtering, the odds are low that Fortify were to recognize it and stop producing the issue. I did not try that. Fix : Analysis found that this is a false positive result; no code changes are required. Attachments. But it seems that fortify is not considering these checks as a valid null check. Fix: Modified rules and code to no longer dereference a null pointer. CODETOOLS-7900078 Fortify: Analize and fix "Redundant Null Check" issues. All rights reserved. There are too few details in this report for us to be able to work on it. Warn if the compiler detects paths that trigger erroneous or undefined behavior due to dereferencing a null pointer. This type of 'return early' pattern is very common with validation as it avoids nested scopes thus making the code easier to read in general. That's why it's perfectly OK to assign null to variables or pass null into a method. we have been using fortify tool in our code to check for security vulnerabilities. Fix Suggenstion null null Null 12NULL_RETURNS. "The good news about computers is that they do what you tell them to do. A-143, 9th Floor, Sovereign Corporate Tower, We use cookies to ensure you have the best browsing experience on our website. PS: Yes, Fortify should know that these properties are secure. How to add an element to an Array in Java? acknowledge that you have read and understood our, Data Structure & Algorithm Classes (Live), Data Structure & Algorithm-Self Paced(C++/JAVA), Android App Development with Kotlin(Live), Full Stack Development with React & Node JS(Live), GATE CS Original Papers and Official Keys, ISRO CS Original Papers and Official Keys, ISRO CS Syllabus for Scientist/Engineer Exam, Spring Boot - Start/Stop a Kafka Listener Dynamically, Parse Nested User-Defined Functions using Spring Expression Language (SpEL), Split() String method in Java with examples, Object Oriented Programming (OOPs) Concept in Java. encryption key? The CWE Top 25. . What I mean is, you must remember to set the pointer to NULL or it won't work. The program can dereference a null-pointer because it does not check the return value of a function that might return null. In this article. If that variable hasn't had a reference assigned, it's a null reference, which (for internal/historical reasons) is referred to as a null pointer. CVE-2009-3620. at com.fortify.sca.frontend.FrontEndSession.runSingleFrontEnd(FrontEndSession.java:231) [fortify-sca-18.20.1071.jar:?] Why not use a Regular Expression? Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. Site design / logo 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. CODETOOLS-7900082 Fortify: Analize and fix "Missing Check against Null" issue. Note: Before moving to this, to fix the issue in Example 1 we can print. But, when you try to declare a reference type, something different happens. Now, let us move to the solution for this error. CVE-2009-3547. In this paper we discuss some of the challenges of using a null dereference analysis in practice, and reasons why developers may not feel it necessary to change code to prevent ever possible null dereference. Once the value of the location is obtained by the pointer, this pointer is considered dereferenced. Follows a very simple code sample that should reproduce the issue: In this simple excerpt Fortify complains that "typedObj" can be null in the return statement. Thus, enabling the attacker do delete files or otherwise compromise your system. I have a solution to the Fortify Path Manipulation issues. Java/JSP Abstract The program can dereference a null-pointer because it does not check the return value of a function that might return null. If you get an exception, don't catch it and return null, instead wrap and rethrow the exception. To subscribe to this RSS feed, copy and paste this URL into your RSS reader. a NULL pointer dereference would then occur in the call to strcpy(). This does pass the Fortify review. Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function ( CWE-456) causes a crash because of a null pointer dereference ( CWE-476 ). Fortify source code analyzer is giving lot's of "Null Dereference" issues because we have used Apache Utils to ensure null check. +1 (416) 849-8900. Copyright 2023 Open Text Corporation. How to resolve this issue? Thus, enabling the attacker do delete files or otherwise compromise your system. 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 When we dereference a pointer, then the value of the . Note that you can copy references without accessing the object it references.