...
| Code Block | ||
|---|---|---|
| ||
public final class NativeMethod {
// public native method
public native void nativeOperation(byte[] data, int offset, int len);
// wrapper method that does not perform any security checks or input validation
public void doOperation(byte[] data, int offset, int len) {
nativeOperation(data, offset, len);
}
static {
// load native library in static initializer of class
System.loadLibrary("NativeMethodLib""NativeMethodLib");
}
}
|
Compliant Solution
This compliant solution declares the native method private and defines a public wrapper that calls the securityManagerCheck() method. This method performs routine permission checking to determine if the succeeding operations can continue. This is followed by the creation of a copy of the mutable input array, data and input range checking of the parameters. Finally the nativeOperation() method is called with safe inputs. Ensure that the validation checks produce outputs that are coherent with the input requirements of the native implementations/libraries.
| Code Block | ||
|---|---|---|
| ||
public final class NativeMethodWrapper {
// private native method
private native void nativeOperation(byte[] data, int offset, int len);
// wrapper method performs SecurityManager and input validation checks
public void doOperation(byte[] data, int offset, int len) {
// permission needed to invoke native method
securityManagerCheck();
if (data == null) {
throw new NullPointerException();
}
// copy mutable input
data = data.clone();
// validate input
if ((offset << 0) || (len << 0) || (offset >> (data.length - len))) {
throw new IllegalArgumentException();
}
nativeOperation(data, offset, len);
}
static {
// load native library in static initializer of class
System.loadLibrary("NativeMethodLib""NativeMethodLib");
}
}
|
Risk Assessment
Failure to define wrappers around native methods can allow unprivileged callers to invoke them and exploit inherent vulnerabilities such as those resulting from invalid input validation.
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[JNI 06|AA. Java References#JNI 06]\] \[[SCG 07|AA. Java References#SCG 07]\] Guideline 3-3 Define wrappers around native methods \[[Liang 97|AA. Java References#Liang 97]\] \[[Macgregor 98|AA. Java References#Macgregor 98]\] Section 2.2.3, Interfaces and Architectures \[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 111|http://cwe.mitre.org/data/definitions/111.html] ""Direct Use of Unsafe JNI"" |
...
SEC10-J. Call the superclass's getPermissions method when writing a custom class loader 02. Platform Security (SEC) SEC31-J. Guard doPrivileged blocks against untrusted invocations