Page History

The static method java.security.AccessController.doPrivileged() affirms that the invoking method assumes responsibility for enforcing its own privileges and that the access permissions of its callers should be ignored. For example, an application could have permissions to operate on a sensitive file, however, a caller of the application may be allowed to operate with only the basic permissions. Invoking doPrivileged() in this context allows the application operating with basic permissions to use the sensitive file, for instanceexample, when a user password change request requires an unprivileged application to use a more privileged application to set the new password.This rule concerns sensitive information escaping from a doPrivileged() block. For information about untrusted information entering a doPrivileged() block, see SEC01-J. Do not allow tainted variables in doPrivileged blocks.

Noncompliant Code Example

In this noncompliant code example, the doPrivileged() method is called from the openPasswordFile() method. The openPasswordFile() method is privileged and returns a FileInputStream for the sensitive password file to its caller. Since Because the method is public, it could be invoked by an untrusted caller.

...

This compliant solution mitigates the vulnerability by declaring openPasswordFile() to be private. Consequently, an untrsuted untrusted caller can call changePassword() but cannot directly access the open password fileinvoke openPasswordFile().

class Password {
  public static void changePassword() {
    // ...
  }

  private static FileInputStream openPasswordFile() {
    // ...
  }
}

...

But if none of the possible exceptions reveals sensitive information, we can use an equivalent mechanism that allows exceptions to be wrapped , consequently providing to provide better diagnostic information for to the caller. For example, an applet that lacks read-access to system files that contain fonts can accomplish the task from a privileged block without revealing any sensitive information. When non-sensitive exceptions provide more information, the client is better able to recognize the symptoms of a read failure.

...

...