...
| Wiki Markup |
|---|
Consider two classes belonging to different protection domains. One of them is malicious whereas the other is trusted. If the malicious class extends the trusted {{public}} non-final class and inherits without overriding a method of the trusted class, the fully qualified invocation of the malicious class's version of the method uses the protection domain of the trusted class. In this case, the trusted class's permissions are examined to execute the method \[[Gong 2003|java:AA. JavaBibliography#Gong References#Gong 03]\]. |
One suggestion is that at all points where the class can be instantiated, there must be checks to ensure that the instance being created has the same type as the class. If the type is found to be that of a subclass instead of the non-final public superclass's type, a security manager check can be performed to ensure that malicious classes cannot misuse the class. This approach is insecure because it allows a malicious class to add a finalizer and obtain a partially initialized instance of the class. (See guideline OBJ04-J. Do not allow partially initialized objects to be accessed.) For non-final classes, the method that performs the security manager check must be passed as an argument to a private constructor so that Object's constructor does not exit before the security check is performed.
...
| Wiki Markup |
|---|
This noncompliant code example installs a security manager check in the constructor of the non-final class. Access is denied if the security manager detects that a subclass without the requisite permissions, is trying to instantiate the superclass \[[SCG 2007|java:AA. JavaBibliography#SCG References#SCG 07]\]. |
| Code Block | ||
|---|---|---|
| ||
public class NonFinal {
public NonFinal() {
// Invoke java.lang.Object.getClass to get class instance
Class c = getClass();
// Confirm class type
if (c != NonFinal.class) {
// Check the permission needed to subclass NonFinal
securityManagerCheck(); // throws a security exception if not allowed
}
// ...
}
}
|
...
| Wiki Markup |
|---|
\[[McGraw 2000|java:AA. Java References#McGrawBibliography#McGraw 00]\] Chapter Seven Rule 3: "Make Everything Final, Unless There's a Good Reason Not To" \[[Lai 2008|java:AA. Java References#LaiBibliography#Lai 08]\] \[[SCG 2007|java:AA. JavaBibliography#SCG References#SCG 07]\] Guideline 1-2 "Limit the extensibility of classes and methods" \[[Gong 2003|java:AA. JavaBibliography#Gong References#Gong 03]\] Chapter 6: "Enforcing Security Policy" \[[Bloch 2008|java:AA. Java References#BlochBibliography#Bloch 08]\] Item 1: "Consider static factory methods instead of constructors" |
...