| Wiki Markup |
|---|
A nested class is any class whose declaration occurs within the body of another class or interface \[[JLS 2005|AA. Bibliography#JLS 05]\]. The use of a nested class is error-prone unless the semantics are well understood. A common notion is that only the outer class can access the contents of the nested class. Not only does the nested class have access to the private fields of the outer class, the same fields can be accessed by another class inwithin the package depending on whether the nested class is declared public or if it contains public methods or constructors. By default, the {{javac}} compiler converts the accessibility of private methods of a nested class to package-private. |
| Wiki Markup |
|---|
Also, according to the _Java Language Specification_ \[[JLS 2005|AA. Bibliography#JLS 05]\], [Section 8§8.3|http://java.sun.com/docs/books/jls/third_edition/html/classes.html#8.3] "Field Declarations" |
...
The Java language system weakens the accessibility of sensitive, private entities in inner classes, which can result in a security weakness.
...
Automated detection of non-private nested classes that define non-private members and constructors is straight-forward. However, this guideline applies only when those classes could potentially expose sensitive data or operations from the outer class. Detection of sensitive data or operations requires programmer assistance.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Related Guidelines
MITRE CWE: CWE-492 "Use of Inner Class Containing Sensitive Data"
...
| Wiki Markup |
|---|
\[[JLS 2005|AA. Bibliography#JLS 05]\] [Section 8§8.1.3, Inner Classes and Enclosing Instances|http://java.sun.com/docs/books/jls/third_edition/html/classes.html#8.1.3] and [Section 8§8.3|http://java.sun.com/docs/books/jls/third_edition/html/classes.html#8.3] "Field Declarations" \[[Long 2005|AA. Bibliography#Long 05]\] Section 2§2.3, Inner Classes \[[McGraw 2000|AA. Bibliography#McGraw 00]\] Securing Java, Getting Down to Business with Mobile Code |
...
OBJ12-J. Do not leak references to inner class objects when the outer class object maintains sensitive data 04. Object Orientation (OBJ) 05. Methods (MET)