This rule is defined by the following Java class: net.sourceforge.pmd.rules.sunsecure.MethodReturnsInternalArray
Example:
public class SecureSystem { UserData [] ud; public UserData [] getUserData() { // Don't return directly the internal array, return a copy return ud; } }