...
Code Block | ||
---|---|---|
| ||
class SimpleObject<E,V>SimpleObject<E,V> implements Serializable { final static long serialVersionUID = -2648720192864531932L; private HashMap<E,V>HashMap<E,V> ssnMap; public SimpleObject() { ssnMap = new HashMap<E,V>HashMap<E,V>(); } public Object getdata(E key) { return ssnMap.get(key); } public void setData(E key, V data) { ssnMap.put(key, data); } } |
...
Code Block | ||
---|---|---|
| ||
class SignSealUtility<E,V>SignSealUtility<E,V> implements Serializable { final static long serialVersionUID = 2648720192864531932L; private HashMap<E,V>HashMap<E,V> ssnMap; private SealedObject sealedSsnMap; private SignedObject signedSsnMap; public SignSealUtility() { ssnMap = new HashMap<E,V>HashMap<E,V>(); } public void seal(Cipher cipher) throws Exception { sealedSsnMap = new SealedObject(ssnMap, cipher); // Now set the Map to null so that original data does not remain in cleartext ssnMap = null; } public void unseal(Cipher cipher) throws Exception { ssnMap = (HashMap<E,V>HashMap<E,V>)sealedSsnMap.getObject(cipher); } public void sign(Signature sig, PrivateKey key) throws Exception { signedSsnMap = new SignedObject(ssnMap, key, sig); ssnMap = null; } public void unsign(Signature sig, PublicKey key) throws Exception { if(signedSsnMap.verify(key, sig)) { ssnMap = (HashMap<E,V>HashMap<E,V>)signedSsnMap.getObject(); } } public Object getdata(E key) throws Exception { return ssnMap.get(key); } public void setData(E key, V data) throws Exception { ssnMap.put(key, data); } } |
...
Wiki Markup |
---|
\[[API 06|AA. Java References#API 06]\] \[[Steel 05|AA. Java References#Steel 05]\] Chapter 10: Securing the Business Tier, Obfuscated Transfer Object \[[Gong 03|AA. Java References#Gong 03]\] 9.10 Sealing Objects \[[Harold 99|AA. Java References#Harold 99]\] Chapter 11: Object Serialization, Sealed Objects \[[Neward 04|AA. Java References#Neward 04]\] Item 64: Use SignedObject to provide integrity of Serialized objects and Item 65: Use SealedObject to provide confidentiality of Serializable objects \[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 319|http://cwe.mitre.org/data/definitions/319.html] ""Cleartext Transmission of Sensitive Information"" |
...
SEC05-J. Minimize accessibility of classes and their members 02. Platform Security (SEC) SEC07-J. Do not grant untrusted code access to classes existing in forbidden packages