...
| Wiki Markup |
|---|
According to the Java API \[[API 2006|AA. Java References#APIBibliography#API 06]\] Class {{Runtime}}, method {{addShutdownHook}}: |
...
- Hook threads should be light-weight and simple
- They should be thread safe
- They should hold locks when accessing data and release them when done
Wiki Markup They should not rely on system services as the services themselves may be shutting down (for example, the logger may shutdown from another hook). Instead of one service it may be better to run a series of shutdown tasks from one thread by using a single shutdown hook. \[[Goetz 2006|AA. JavaBibliography#Goetz References#Goetz 06]\]
This compliant solution shows the standard method to install a hook.
...
| Wiki Markup |
|---|
*EX1:* It is permissible for a command line utility to call {{System.exit()}} or terminate prematurely, for example, when the required number of arguments are not input. \[[Bloch 2008|AA. Java References#BlochBibliography#Bloch 08]\] and \[[ESA 2005|AA. Java References#ESABibliography#ESA 05]\] |
Risk Assessment
Allowing inadvertent calls to System.exit() may lead to denial of service.
...
| Wiki Markup |
|---|
\[[API 2006|AA. JavaBibliography#API References#API 06]\] [method checkExit()|http://java.sun.com/j2se/1.4.2/docs/api/java/lang/SecurityManager.html#checkExit(int)], Class Runtime, method addShutdownHook \[[Kalinovsky 2004|AA. Java References#KalinovskyBibliography#Kalinovsky 04]\] Chapter 16 Intercepting a Call to System.exit \[[Austin 2000|AA. JavaBibliography#Austin References#Austin 00]\] [Writing a Security Manager|http://java.sun.com/developer/onlineTraining/Programming/JDCBook/signed2.html] \[[Darwin 2004|AA. JavaBibliography#Darwin References#Darwin 04]\] 9.5 The Finalize Method \[[Goetz 2006|AA. Java References#GoetzBibliography#Goetz 06]\] 7.4. JVM Shutdown \[[ESA 2005|AA. JavaBibliography#ESA References#ESA 05]\] Rule 78: Restrict the use of the System.exit method \[[MITRE 2009|AA. Java References#MITREBibliography#MITRE 09]\] [CWE ID 382|http://cwe.mitre.org/data/definitions/382.html] "J2EE Bad Practices: Use of System.exit()" |
...