Page History

...

Noncompliant Code Example

The untrustedCode method of class Untrusted invokes loadLib method of class NativeCode in this noncompliant example. This is dangerous as the library gets loaded on behalf of the untrusted code. Accepting tainted inputs from untrusted code can further exacerbate this issue. In essence, the untrusted code's class loader may be able to load the intended library even if it does not have sufficient permissions.

...

AccessController.doPrivileged(new PrivilegedAction() {
  public Object run() { 
    System.loadLibrary("awt");
    return null; 
  }
});

Noncompliant Code Example

The single argument Class.forname method is another example of an API that uses its immediate caller's class loader to load a desired class. Untrusted code can indirectly abuse this API.

Class c = Class.forName(className);

Compliant Solution

Ensure that untrusted code cannot invoke the affected APIs directly or indirectly (that is, via a call to an invoking method). Do not operate on tainted inputs and make sure that internal objects are not returned to untrusted code.

Risk Assessment

Allowing untrusted code to load libraries using the immediate caller's class loader may seriously compromise the security of a java application.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[SCG 07|AA. Java References#SCG 07]\] Guideline 6-3 Safely invoke standard APIs that perform tasks using the immediate caller's class loader instance

...