Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migrated to Confluence 4.0

Wiki Markup Native methods are defined in Java and written in languages such as C and C++ \[ [JNI 2006|AA. References#JNI 06]\]. The added extensibility comes at the cost of flexibility and portability because the code no longer conforms to the policies enforced by Java. Native methods have been used for performing platform-specific operations, interfacing with legacy library code, and improving program performance \[ [Bloch 2008|AA. References#Bloch 08]\].

Defining a wrapper method facilitates installing appropriate security manager checks, validating arguments passed to native code, validating return values, defensively copying mutable inputs, and sanitizing untrusted data. Consequently, every native method must be private and must be invoked only by a wrapper method.

...

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

SEC08-J

medium

probable

high

P4

L3

Automated Detection

...

Automated detection is not feasible in the fully general case. However, an approach similar to Design Fragments \ [[Fairbanks 2007|AA. References#Fairbanks 07]\] could assist both programmers and static analysis tools.

Related Guidelines

MITRE CWE

CWE-111. Direct use of unsafe JNI

Secure Coding Guidelines for the Java Programming Language, Version 3.0

Guideline 3-3. Define wrappers around native methods

Bibliography

...

[ [Fairbanks 2007AA. References#Fairbanks 07]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="48ffc191-afea-417f-b68f-01ae2c31ec39"><ac:plain-text-body><![CDATA[

[ [JNI 2006AA. References#JNI 06]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="833a4da2-4551-4fc7-8612-dafbb02e7c24"><ac:plain-text-body><![CDATA [ [[Liang 1997AA. References#Liang 97]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="baea3fdd-cb1a-41cc-a4c3-48a9e46b469b"><ac:plain-text-body><![CDATA[

[[Macgregor 1998AA. References#Macgregor 98]]

Section 2.2.3, Interfaces and Architectures ]]></ac:plain-text-body></ac:structured-macro>

...

      14. Platform Security (SEC)      15. Runtime Environment (ENV)