When System.exit() is invoked, all programs and threads running on the JVM terminate. This can result in denial-of-service attacks, for example, a web server can stop servicing users upon encountering an untimely call to System.exit().
...
| Code Block | ||
|---|---|---|
| ||
public class InterceptExit {
public static void main(String[] args) {
// ...
System.exit(1); // Abrupt exit
System.out.println(""This is never executed"");
}
}
|
Compliant Solution
This compliant solution installs a custom security manager PasswordSecurityManager that overrides the checkExit() method defined in the SecurityManager class. An internal flag is used to keep track of whether the exit is permitted or not. The method setExitAllowed() is used to set this flag. If the flag is not set (false), a SecurityException is thrown. The System.exit() call is not allowed to execute by catching the SecurityException in a try-catch block. After intercepting and performing mandatory clean-up operations, the setExitAllowed() method is invoked. As a result, the program exits gracefully.
| Code Block | ||
|---|---|---|
| ||
class PasswordSecurityManager extends SecurityManager{
private boolean isExitAllowedFlag;
public PasswordSecurityManager(){
super();
isExitAllowedFlag = false;
}
public boolean isExitAllowed(){
return isExitAllowedFlag;
}
@Override public void checkExit(int status) {
if(!isExitAllowed())
throw new SecurityException();
}
public void setExitAllowed(boolean f) {
isExitAllowedFlag = f;
}
}
public class InterceptExit {
public static void main(String[] args) {
PasswordSecurityManager secManager = new PasswordSecurityManager();
System.setSecurityManager(secManager);
try {
// ...
System.exit(1); // Abrupt exit call
}
catch (Throwable x) {
if (x instanceof SecurityException) {
System.out.println(""Intercepted System.exit()"");
} else {
// Forward to exception handler
}
}
// ...
secManager.setExitAllowed(true); // Permit exit
// System.exit() will work subsequently
// ...
}
}
|
...
| Code Block | ||
|---|---|---|
| ||
public class InterceptExit {
public static void main(String[] args) {
System.out.println(""Regular code block"");
// Abrupt exit such as ctrl + c key pressed
System.out.println(""This never executes"");
}
}
|
Compliant Solution
The addShutdownHook() method of java.lang.Runtime helps to perform clean-up operations in the abrupt termination scenario. When the shutdown is initiated, the hook thread starts to run concurrently with other JVM threads.
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] [method checkExit()|http://java.sun.com/j2se/1.4.2/docs/api/java/lang/SecurityManager.html#checkExit(int)], Class Runtime, method addShutdownHook \[[Kalinovsky 04|AA. Java References#Kalinovsky 04]\] Chapter 16 Intercepting a Call to System.exit \[[Austin 00|AA. Java References#Austin 00]\] [Writing a Security Manager|http://java.sun.com/developer/onlineTraining/Programming/JDCBook/signed2.html] \[[Darwin 04|AA. Java References#Darwin 04]\] 9.5 The Finalize Method \[[Goetz 06|AA. Java References#Goetz 06]\] 7.4. JVM Shutdown \[[ESA 05|AA. Java References#ESA 05]\] Rule 78: Restrict the use of the System.exit method \[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 382|http://cwe.mitre.org/data/definitions/382.html] ""J2EE Bad Practices: Use of System.exit()"" |
...
EXC03-J. Try to gracefully recover from system errors 13. Exceptional Behavior (EXC) EXC05-J. Use a class dedicated to reporting exceptions