Page History

Consider two classes belonging to different protection domains. One of them is malicious whereas the other is trusted. If the malicious class extends the trusted {{public}} non-final class and inherits without overriding a method of the trusted class, the fully qualified invocation of the malicious class's version of the method uses the protection domain of the trusted class. In this case, the trusted class's permissions are examined to execute the method. \[[Gong 032003|java:AA. Java References#Gong 03]\])

This noncompliant code example installs a security manager check in the constructor of the non-final class. Access is denied if the security manager detects that a subclass without the requisite permissions, is trying to instantiate the superclass. \[[SCG 072007|java:AA. Java References#SCG 07]\]

\[[McGraw 002000|java:AA. Java References#McGraw 00]\] Chapter Seven Rule 3: "Make Everything Final, Unless There's a Good Reason Not To"
\[[Lai 082008|java:AA. Java References#Lai 08]\]
\[[SCG 072007|java:AA. Java References#SCG 07]\] Guideline 1-2 "Limit the extensibility of classes and methods"
\[[Gong 032003|java:AA. Java References#Gong 03]\] Chapter 6: "Enforcing Security Policy"
\[[Bloch 082008|java:AA. Java References#Bloch 08]\] Item 1: "Consider static factory methods instead of constructors"