Page History

In Java SE 6 and Java SE 7, privileged code either uses the AccessController mechanism or must be signed by an owner (or provider) who is trusted by the user. Attackers could link privileged code with malicious code if the privileged code directly or indirectly invokes code from another package. In fact, trusted Trusted jar files often contain code that lacks direct privileges, but that depends on privileged code; such code is known as security-sensitive code. If an attacker can link security-sensitive code with malicious code, they can indirectly cause incorrect behavior with sensitive data. This is called a mix and match attack.

Execution of untrusted code causes loss of privileges. When trusted code calls some untrusted code that attempts to perform some action requiring permissions withheld by the security policy, the action is not allowed. However, privileged code may use a class that exists in an untrusted container and performs only unprivileged operations. If the attacker were to replace this class with a malicious implementation, the trusted code would retrieve incorrect results.

...

Sealing a JAR file automatically enforces the requirement of keeping privileged code together. In addition, it is important to adhere to rule OBJ02-J. Minimize the accessibility of classes and their members.

Noncompliant Code Example (

...

Privileged Code)

This noncompliant code example uses a doPrivileged block and calls a method defined in a class that exists in a different, untrusted jar file.

...

This example comes close to violating SEC01-J. Do not allow tainted variables in privileged blocks, but does not do so. It instead allows potentially tainted code in its doPrivileged() block, which is a similar issue.

Noncompliant Code Example (security-sensitive code)

This noncompliant code example improves upon the previous one example by moving the use of the RetValue class outside the doPrivileged() block.

...

To seal a package, use the sealed attribute in the jar file's manifest file header, as shown belowfollows.

Name: trusted/ // package name
Sealed: true  // sealed attribute

...

...