Page History

Security manager checks may be allowed to get bypassed depending on the immediate caller's class loader. When an API (See see table below) is invoked on a class object, a comparison is run between the immediate caller's class loader and that of the class object. The class object is the object on which an API is invoked. For instance, in the presence of a security manager, the getSystemClassLoader and getParent methods succeed only if the caller's class loader is the delegation ancestor of the current class loader or if the caller's class loader is the same as the current one or if the code in the current execution context has the RunTimePermission, namely "getClassLoader".

...

import java.util.Date;

public class exceptionExceptionExample
{
    public static void untrustedCode()
    {
    	 Date now = new Date();
         Class<?> dateClass = now.getClass();
         createInstance(dateClass);
    }
    public static void createInstance(Class<?> dateClass)
    {
        try
        {   // Create another Date object using the Date Class
            Object o = dateClass.newInstance();
            if (o instanceof Date)
            {
                Date d = (Date)o;
                System.out.println("The time is: " + d.toString());
            }
        }
        catch (InstantiationException ie) { System.out.println(ie.toString()); }
        catch (IllegalAccessException lae) { System.out.println(iae.toString()); }    	
    }
}

Compliant Solution

Do not accept Class, ClassLoader or Thread instances from untrusted code. If inevitable, safely acquire these instances by ensuring they come from trusted sources. Additionally, make sure to discard tainted inputs from untrusted code. Likewise, objects returned by the affected methods should not be propagated back to the untrusted code.

Risk Assessment

TODOBypassing Securitymanager checks may seriouslu compromise the security of a Java application.

Automated Detection

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[Gong 03|AA. Java References#Gong 03]\] 

4.3.2 Class Loader Delegation

 Hierarchy
\[[SCG 07|AA. Java References#SCG 07]\] Guideline 6-2 Safely invoke standard APIs that bypass SecurityManager checks depending on the immediate caller's class loader