Page History

A system's security policy determines which information is sensitive. Sensitive data may include user information such as social security or credit card numbers, passwords, or private keys.

Java is widely considered to be a type-safe language \[[LSOD 02|AA. Bibliography#LSOD 02]\]. For that reason, it should not be possible to compromise a Java program by misusing the type system. To see why type safety is so important, consider the following types:

public class TowerOfLondon {
  private Treasure theCrownJewels;
  ...
}

public class GarageSale {
  public Treasure myCostumeJewerly;
  ...
}

If these two types could be confused, it would be possible to access the private field {{theCrownJewels}} as if it were the public field {{myCostumeJewerly}}. More generally, a _type confusion attack_ could allow Java security to be compromised by making the internals of the security manager open to abuse. A team of researchers at Princeton University showed that any type confusion in Java could be used to completely overcome Java’s security mechanisms (see Securing Java Ch. 5, Sec. 7 \[[McGraw 1999|AA. Bibliography#McGraw 1999]\]).

Java’s type safety means that fields that are declared private or protected or that have default (package) protection should not be globally accessible. However, there are a number of vulnerabilities built in to Java that enable this protection to be overcome. These should come as no surprise to the Java expert, as they are well documented, but they may trap the unwary.

A field that is declared public may be directly accessed by any part of a Java program and may be modified from anywhere in a Java program (unless the field is declared final). Clearly, sensitive information must not be stored in a public field, as it could be compromised by anyone who could access the JVM running the program.

Java software components provide many opportunities to output sensitive information. Rules that address the mitigation of sensitive information disclosure include:

...