Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Edited by sciSpider Java v3.0

...

Code Block
bgColor#FFCCCC
  
// Exception handling has been omitted for the sake of brevity
class EchoServer { 
  public static void main(String[] args) throws IOException { 
    ServerSocket serverSocket = new ServerSocket(10007); 
    Socket socket = serverSocket.accept();
			
    PrintWriter out = new PrintWriter(socket.getOutputStream(), true); 
    BufferedReader in = new BufferedReader(
      new InputStreamReader(socket.getInputStream())); 

    String inputLine; 
    while ((inputLine = in.readLine()) != null) { 
      System.out.println(inputLine); 
      out.println(inputLine); 
    }
      
    // close out, in, socket (preferably in a try-finally block)   
  }
}

class EchoClient {
  public static void main(String[] args) throws IOException { 
    Socket socket = new Socket("localhost""localhost", 9999);
						
    PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
    BufferedReader in = new BufferedReader(
      new InputStreamReader(socket.getInputStream()));

    BufferedReader stdIn = new BufferedReader(
      new InputStreamReader(System.in));
			
    String userInput;
    while ((userInput = stdIn.readLine()) != null) {
      out.println(userInput);
      System.out.println(in.readLine());
    } 

    // close out, in, stdIn, socket (preferably in a try-finally block)   
  }
}

...

Code Block
bgColor#CCCCFF
// Exception handling has been omitted for the sake of brevity
class EchoServer {
  public static void main(String[] args) throws IOException {   
    SSLServerSocketFactory sslserversocketfactory =
      (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
    SSLServerSocket sslserversocket =
      (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
    SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

    PrintWriter out = new PrintWriter( sslsocket.getOutputStream(),true);
    BufferedReader in = new BufferedReader(
      new InputStreamReader( sslsocket.getInputStream()));
            
    String inputLine;             
    while ((inputLine = in.readLine()) != null) { 
      System.out.println(inputLine); 
      out.println(inputLine); 
    } 

    // close out, in, sslsocket (preferably in a try-finally block)
  }
}

class EchoClient {
  public static void main(String[] args) throws IOException {
    SSLSocketFactory sslsocketfactory =
      (SSLSocketFactory) SSLSocketFactory.getDefault();
    SSLSocket sslsocket =
      (SSLSocket) sslsocketfactory.createSocket("localhost""localhost", 9999);

    PrintWriter out = new PrintWriter(sslsocket.getOutputStream(), true);
    BufferedReader in = new BufferedReader(
      new InputStreamReader(sslsocket.getInputStream()));
			
    BufferedReader stdIn = new BufferedReader(
      new InputStreamReader(System.in));
            
    String userInput;
    while ((userInput = stdIn.readLine()) != null) {
      out.println(userInput);
      System.out.println(in.readLine());
    }
  
    // close out, in, stdIn, sslsocket (preferably in a try-finally block)
  }
}

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Exceptions

EX1: Because of the mechanisms that SSLSockets provide to ensure the secure transfer of packets, significant performance overhead may result. If no sensitive information is being transmitted, or the channel is not prone to attacks, regular Sockets are sufficient.

...

Wiki Markup
\[[API 06|AA. Java References#API 06]\] 
\[[Gong 03|AA. Java References#Gong 03]\] 11.3.3 ""Securing RMI Communications""
\[[Ware 08|AA. Java References#Ware 08]\]
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 311|http://cwe.mitre.org/data/definitions/311.html] ""Failure to Encrypt Sensitive Data""

...

SEC08-J. Define custom security permissions for fine grained security            02. Platform Security (SEC)            SEC10-J. Call the superclass's getPermissions method when writing a custom class loader