...
Defining a wrapper method facilitates installing appropriate security manager checks, validating arguments passed to native code, validating return values, defensively copying mutable inputs, and sanitizing untrusted data. Consequently, every native method must be private and must be invoked only by a wrapper method.
...
In this noncompliant code example, the nativeOperation() method is both native and public; thereforeconsequently, untrusted callers may invoke it. Native method invocations bypass security manager checks.
...
| Code Block | ||
|---|---|---|
| ||
public final class NativeMethod {
// publicPublic native method
public native void nativeOperation(byte[] data, int offset, int len);
// wrapperWrapper method that lacks security checks and input validation
public void doOperation(byte[] data, int offset, int len) {
nativeOperation(data, offset, len);
}
static {
// loadLoad native library in static initializer of class
System.loadLibrary("NativeMethodLib");
}
}
|
...
| Code Block | ||
|---|---|---|
| ||
public final class NativeMethodWrapper {
// privatePrivate native method
private native void nativeOperation(byte[] data, int offset, int len);
// wrapperWrapper method performs SecurityManager and input validation checks
public void doOperation(byte[] data, int offset, int len) {
// permissionPermission needed to invoke native method
securityManagerCheck();
if (data == null) {
throw new NullPointerException();
}
// copyCopy mutable input
data = data.clone();
// validateValidate input
if ((offset < 0) || (len < 0) || (offset > (data.length - len))) {
throw new IllegalArgumentException();
}
nativeOperation(data, offset, len);
}
static {
// loadLoad native library in static initializer of class
System.loadLibrary("NativeMethodLib");
}
}
|
...
Failure to define wrappers around native methods can allow unprivileged callers to invoke them and exploit inherent vulnerabilities such as buffer overflows in native libraries.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
JNI00-J | mediumMedium | probableProbable | highHigh | P4 | L3 |
Automated Detection
Automated detection is not feasible in the fully general case. However, an approach similar to Design Fragments [Fairbanks 2007] could assist both programmers and static analysis tools.
Related Guidelines
CWE-111. , Direct use Use of unsafe Unsafe JNI | |
Secure Coding Guidelines for the Java Programming LanguageSE, Version 45.0 | Guideline 5-3 . / INPUT-3: Define wrappers around native methods |
...
| |
[JNI 2006] |
|
| |
Section 2.2.3, "Interfaces and Architectures" |
...