Page History

...

...

Noncompliant Code Example

The createInstance method is the immediate caller of java.lang.Class.newInstance <TO BE CONFIRMED> in this non-compliant noncompliant example. The newInstance method is being invoked on the dateClass class object. The issue is that the untrustedCode method can trigger the instantiation of a new class even though it should not have the permission to do so. This behavior is not caught by the security manager.

import java.util.Date;

public class exception
{
    public static void untrustedCode()
    {
    	 Date now = new Date();
         Class<?> dateClass = now.getClass();
         createInstance(dateClass);
    }
    public static void createInstance(Class<?> dateClass)
    {
        try
        {   // Create another Date object using the Date Class
            Object o = dateClass.newInstance();
            if (o instanceof Date)
            {
                Date d = (Date)o;
                System.out.println("The time is: " + d.toString());
            }
        }
        catch (InstantiationException ie) { System.out.println(ie.toString()); }
        catch (IllegalAccessException lae) { System.out.println(iae.toString()); }    	
    }
}

Compliant Solution

Do not accept Class, ClassLoader or Thread instances from untrusted code. If inevitable, safely acquire these instances by ensuring they come from trusted sources. Additionally, make sure to discard tainted inputs from untrusted code. Likewise, objects returned by the affected methods should not be propagated back to the untrusted code.

Risk Assessment

TODO

Automated Detection

TODO

References

Inside Java 2 Platform Security, 4.3.2 Class Loader Delegation Hierarchy
Sun Secure Coding Guidelines