...
| Code Block | ||
|---|---|---|
| ||
BigInteger msg = new BigInteger("123");
msg = msg.modPow(exp, m); // Always returns 1
// Malicious subclassing of java.math.BigInteger
class BigInteger extends java.math.BigInteger {
private int value;
public BigInteger(String str) {
super(str);
value = Integer.parseInt( str);
}
public setValue(int value) {
this.value = value;
}
@Override public java.math.BigInteger modPow(java.math.BigInteger exponent, java.math.BigInteger m) {
this.value = ((int) (Math.pow( this.value, exponent))) % m;
return this;
}
}
|
...
| Code Block | ||
|---|---|---|
| ||
public class BigInteger {
public BigInteger(String str) {
this( str, check( this.getClass())); // throws a security exception if not allowed
}
private BigInteger(String str, boolean securityManagerCheck) {
// regular construction goes here
}
private static boolean check(Class c) {
// Confirm class type
if (c != BigInteger.class) {
// Check the permission needed to subclass BigInteger
securityManagerCheck(); // throws a security exception if not allowed
}
return true;
}
}
|
Noncompliant Code Example (Data-Driven Execution)
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="fc7b5976f44d65fe-e0c243d5-40a4431f-b362b5bd-a08f274a595d688fb061ddb3"><ac:plain-text-body><![CDATA[ | [[API 2006 | AA. Bibliography#API 06]] | Class BigInteger | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="8c756b23a34cc83f-5edc111b-48d8488f-b422b45e-dfb688d2de1872e4098780d8"><ac:plain-text-body><![CDATA[ | [[Bloch 2008 | AA. Bibliography#Bloch 08]] | Item 1: "Consider static factory methods instead of constructors" | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a4f097549b4c2d40-1271f81f-45fd490d-82d087d1-fc71f1dac77f80c69bfa0bdc"><ac:plain-text-body><![CDATA[ | [[Gong 2003 | AA. Bibliography#Gong 03]] | Chapter 6: "Enforcing Security Policy" | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="529e4d8eafe2715a-602449e4-4a5f4804-b46a816f-957765796d99ce3cfb567719"><ac:plain-text-body><![CDATA[ | [[Lai 2008 | AA. Bibliography#Lai 08]] | Java Insecurity: Accounting for Subtleties That Can Compromise Code | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4c6a190c7105c9e4-19dab5a3-4abf40dd-aaaa9891-384cd1045003ba52c11c4ecf"><ac:plain-text-body><![CDATA[ | [[McGraw 1999 | AA. Bibliography#McGraw 99]] | Chapter Seven Rule 3: "Make Everything Final, Unless There's a Good Reason Not To" | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b6e0a5063da77e12-0bd5bcdf-4f7745a3-9287a1f0-3423bc51e80d499aa8bc2df0"><ac:plain-text-body><![CDATA[ | [[Ware 2008 | AA. Bibliography#Ware 08]] | ]]></ac:plain-text-body></ac:structured-macro> |
...