...
| Wiki Markup |
|---|
This compliant solution moves the call to {{System.loadLibrary()}} outside the {{doPrivileged()}} block. Any operations on the file descriptor {{f\[0\]}} should occur outside the privileged block to make it easier to audit privileged code. However, {{f\[0\]}} must not leak out to untrusted code (see [SEC00-J. Do not allow doPrivileged() blocks to leak sensitive information outside a trust boundary]). As a result, the "operations on the file" must not allow {{f\[0\]}} to escape out of {{changePassword()}}. Minimizing the amount of code that requires elevated privileges eases the necessary task of auditing privileged code. |
| Code Block | ||
|---|---|---|
| ||
public void changePassword() {
final FileInputStream f[] = { null };
AccessController.doPrivileged(new PrivilegedAction() {
public Object run() {
try {
String passwordFile = System.getProperty("user.dir") + File.separator
+ "PasswordFileName";
f[0] = new FileInputStream(passwordFile);
} catch (FileNotFoundException cnf) {
// Forward to handler
}
return null;
}
}); // end of doPrivileged()
// Operations on the file using handle f[0]
// while ensuring that the f[0] reference
// remains contained within changePassword()
System.loadLibrary("LibName");
}
|
Minimizing the amount of code that requires elevated privileges eases the necessary task of auditing privileged code.
Risk Assessment
Failure to follow the principle of least privilege can lead to privilege escalation.
...
Automated Detection
Automated checking is clearly not possible in the general case. We Escape analysis might be able to do something with escape analysis to used to check that we are not leaking privileged data is not leaked provided that privileged data is marked indicated by the user, and even that would be difficult.
Related Guidelines
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5323a1ac5872d3b8-7219dbfd-4e1743e4-a04080b1-b4959adeffebe7c774ed2984"><ac:plain-text-body><![CDATA[ | [ISO/IEC TR 24772:2010 | http://www.aitcnet.org/isai/] | "Privilege Sandbox Issues [XYO]" | ]]></ac:plain-text-body></ac:structured-macro> |
CWE ID 272, "Least Privilege Violation" |
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2b3cab4093b7d976-1517c74f-4aab44fe-aba1a7e2-72ceffe7878e521e44cdb0d1"><ac:plain-text-body><![CDATA[ | [[API 2006 | AA. Bibliography#API 06]] | Class | ]]></ac:plain-text-body></ac:structured-macro> |
...