| Wiki Markup |
|---|
A nested class is any class whose declaration occurs within the body of another class or interface \[[JLS 2005|AA. Bibliography#JLS 05]\]. The use of a nested class is error-prone unless the semantics are well understood. A common notion is that only the outernested class canmay access the contents of the nestedouter class. Not only does the nested class have access to the private fields of the outer class, the same fields can be accessed by another class within the package when the nested class is declared public or if it contains public methods or constructors. As a result the nested class must not expose the private members of the outer class to external classes or packages. |
| Wiki Markup |
|---|
Also, according to the _Java Language Specification_ \[[JLS 2005|AA. Bibliography#JLS 05]\], [§8.3, "Field Declarations"|http://java.sun.com/docs/books/jls/third_edition/html/classes.html#8.3] "Field Declarations,"\[[JLS 2005|AA. Bibliography#JLS 05]\]: |
Note that a
privatefield of a superclass might be accessible to a subclass (for example, if both classes are members of the same class). Nevertheless, aprivatefield is never inherited by a subclass.
...
Compliant Solution
Use the private access specifier for hiding to hide the inner class and all contained methods and constructors.
...
The Java language system weakens the accessibility of sensitive , private entities in inner classes, which can result in a security weakness.
...
Automated Detection
Automated detection of non-private nonprivate nested classes that define non-private nonprivate members and constructors is straightforward. However, this rule applies only when those classes could potentially expose sensitive data or operations from the outer class. Detection of sensitive data or operations requires programmer assistance.
Related Guidelines
Bibliography
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="7991924e62a823f3-cbd907ea-40e945ae-83a9ab11-dce74a8adc37a192a2e7d6ae"><ac:plain-text-body><![CDATA[ | [[JLS 2005 | AA. Bibliography#JLS 05]] | [§8.1.3, Inner Classes and Enclosing Instances | http://java.sun.com/docs/books/jls/third_edition/html/classes.html#8.1.3] ]]></ac:plain-text-body></ac:structured-macro> |
| ||||
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a1d25b39574e1b2f-1448c9c7-4fc445e3-955996c3-9bd17bcc19096a4d28239fc2"><ac:plain-text-body><![CDATA[ | [[Long 2005 | AA. Bibliography#Long 05]] | §2.3, Inner Classes | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="76175b151d48a40b-a7cf8435-4715481d-babab7fa-06dc6f63d983a655bf53c0c8"><ac:plain-text-body><![CDATA[ | [[McGraw 1999 | AA. Bibliography#McGraw 99]] | Securing Java, Getting Down to Business with Mobile Code | ]]></ac:plain-text-body></ac:structured-macro> |
...