SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 17

changes.mady.by.user Dhruv Mohindra

Saved on

compared with

New Version 18

changes.mady.by.user Dhruv Mohindra

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Instances from the class javax.net.ssl.SSLSocket should must be created instead of normal Sockets when transferring objects over communication channels. SSLSockets provide a layer of The class SSLSockets provides security protocols such as SSL or TLS to ensure that the channel is not open to eavesdropping and malicious tampering.

The principal protections included in SSLSockets that are not provided by the Socket class are: Java API]

...

This example shows the use of regular sockets for a server application that does not protect sensitive information in transit. Te The insecure code for the corresponding client application follows the server's code.

Code Block
bgColor#FFCCCC

import java.net.ServerSocket;
import java.net.Socket;
import java.io.*; 

public class EchoServer { 
  public static void main(String[] args) { 
    try { 
      ServerSocket serverSocket = new ServerSocket(10007); 
      Socket socket = serverSocket.accept();
			
      PrintWriter out = new PrintWriter( socket.getOutputStream(),true); 
      BufferedReader in = new BufferedReader(new InputStreamReader( socket.getInputStream())); 

      String inputLine; 

      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
        out.println(inputLine); 
      } 

      out.close(); 
      in.close(); 
      socket.close();  
    }
    catch (Exception e) { 
      /*Handle exception*/
    }   
  }
}

{code:bgColor=#FFCCCC}
import java.io.*;
import java.net.*;

public class EchoClient {
  public static void main(String[] args) {
    try {
      Socket socket = new Socket("localhost", 9999);
						
      PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));

      BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
			
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	System.out.println(in.readLine());
      }

      out.close();
      in.close();
      stdIn.close();
      socket.close();
    }
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}

Compliant solution

This compliant solution makes use of SSLSockets to protect packets using the SSL and TLS security protocols.

Code Block
bgColor#CCCCFF
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import java.io.*;

public class EchoServer {
  public static void main(String[] args) {
    try {
      SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
      SSLServerSocket sslserversocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
      SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

      PrintWriter out = new PrintWriter( sslsocket.getOutputStream(),true);
      BufferedReader in = new BufferedReader(new InputStreamReader( sslsocket.getInputStream()));
            
      String inputLine; 
            
      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
	out.println(inputLine); 
      } 
			
      out.close(); 
      in.close(); 
      sslsocket.close(); 
    } 
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}

import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.*;

public class EchoClient {
  public static void main(String[] args) {
    try {
      SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
      SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("localhost", 9999);

      PrintWriter out = new PrintWriter(sslsocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader(sslsocket.getInputStream()));
			
      BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
            
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	System.out.println(in.readLine());
      }

      out.close();
      in.close();
      stdIn.close();
      sslsocket.close();		
    } 
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}

Note that a program that makes use of SSLSockets will hang block indefinitely if it tries to connect to a port that is not using SSL and, similarly, a program that does not use SSLSockets will hang block when trying to establish a connection through a port that uses SSL.

...

Exceptions

SEC36-EX1: Because of all the mechanisms that SSLSockets provide to ensure the secure transfer of packets, significant performance overhead can be incurredmay result. If no sensitive information is being transmitted, or the channel used is not prone to attacks, the implementation of regular Sockets is are sufficient.

References

Wiki Markup
\[[API 06|AA. Java References#API 06]\] 
\[[Ware 08|AA. Java References#Ware 08]\]

...

SEC07-J. Do not allow the unauthorized construction of classes existing in forbidden packages      01. Platform Security (SEC)      SEC09-J. Prefer using SSLSockets over Sockets for secure data exchange