Page History

"An inner class is a nested class that is not explicitly or implicitly declared static." \[[JLS 05|AA. Java References#JLS 05]\] Section 8.1.3.

Inner class usage is prone to error unless the semantics are well understood. A common notion is that only the outer class can access the contents of the nested inner class(es). Not only does the inner class have access to the private fields of the outer class, the same fields can be accessed by another class in the package depending on whether the inner class is declared public or if it contains public methods/constructors.

...

class Coordinates {
  private int x;
  private int y;

  private class Point {
    private void getPoint() {
      System.out.println("(" + x + "," + y + ")");    
    }
  }
}

class AnotherClass {
  public static void main(String[] args) {
    Coordinates c = new Coordinates();
    Coordinates.Point p = c.new Point();
    p.getPoint();
  }        
}

Risk Assessment

TODOThe Java Language System weakens the access of private entities in inner classes which may result in a security weakness.

Automated Detection

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[JLS 05|AA. Java References#JLS 05]\] Section 8.1.3 Inner Classes and Enclosing

http://java.sun.com/docs/books/jls/third_edition/html/classes.html#8.1.3^{Image Removed}

 Instances
\[[McGraw 00|AA. Java References#McGraw 00]\]