...
Defining a wrapper method facilitates installing appropriate security manager checks, performing input validation before passing the arguments to the native code or when obtaining return values, defensively copying mutable inputs, and sanitizing user inputuntrusted data. As a result every native method must be private, and must be invoked only by a wrapper method.
...
| Code Block | ||
|---|---|---|
| ||
public final class NativeMethodWrapper {
// private native method
private native void nativeOperation(byte[] data, int offset, int len);
// wrapper method performs SecurityManager and input validation checks
public void doOperation(byte[] data, int offset, int len) {
// permission needed to invoke native method
securityManagerCheck();
if (data == null) {
throw new NullPointerException();
}
// copy mutable input
data = data.clone();
// validate input
if ((offset < 0) || (len < 0) || (offset > (data.length - len))) {
throw new IllegalArgumentException();
}
nativeOperation(data, offset, len);
}
static {
// load native library in static initializer of class
System.loadLibrary("NativeMethodLib");
}
}
|
Exceptions
SEC08-EX00: Native methods that do not require security manager checks, validation of arguments or return values, defensively copying of mutable inputs do not need to be wrapped — for example, the standard C function int rand(void).
Risk Assessment
Failure to define wrappers around native methods can allow unprivileged callers to invoke them and consequently exploit inherent vulnerabilities such as those resulting from invalid inputs.
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e7e6b2b93cdfe13b-e67003df-4d3245f0-9b6881d6-d051175e5bc1a47b48fff4ec"><ac:plain-text-body><![CDATA[ | [[Fairbanks 2007 | AA. Bibliography#Fairbanks 07]] |
| ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="7c58b9b3ff473000-837971de-469f4e63-978cb722-839f84a1e2c8303735cec73d"><ac:plain-text-body><![CDATA[ | [[JNI 2006 | AA. Bibliography#JNI 06]] |
| ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="03de2f065b243952-23be4273-448f44e8-aeb38c06-33b6767a31a7c736f63b8b1b"><ac:plain-text-body><![CDATA[ | [[Liang 1997 | AA. Bibliography#Liang 97]] |
| ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="53ca2e5969306705-819e1b43-45344ad8-a6f5bbd4-5ac9412576f33b81363fba22"><ac:plain-text-body><![CDATA[ | [[Macgregor 1998 | AA. Bibliography#Macgregor 98]] | Section 2.2.3, Interfaces and Architectures | ]]></ac:plain-text-body></ac:structured-macro> |
...