Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Edited by sciSpider Java v3.0

...

Code Block
bgColor#FFcccc
class SensitiveHash {
  Hashtable<Integer,String>Hashtable&lt;Integer,String&gt; ht = new Hashtable<Integer,String>Hashtable&lt;Integer,String&gt;();
  
  public void removeEntry(Object key) {
    ht.remove(key);
  }
}

...

Code Block
bgColor#ccccff
class SensitiveHash {
  Hashtable<Integer,String>Hashtable&lt;Integer,String&gt; ht = new Hashtable<Integer,String>Hashtable&lt;Integer,String&gt;();

  void removeEntry(Object key) {
    check("removeKeyPermission"&quot;removeKeyPermission&quot;);
    ht.remove(key);    
  }

  private void check(String directive) {
    SecurityManager sm = System.getSecurityManager();
      if (sm != null) {
        sm.checkSecurityAccess(directive);
      }
  }
}

...

Code Block
bgColor#FFcccc
SecurityManager sm = System.getSecurityManager();

if(sm != null) {  //check if file can be read
  sm.checkRead("&quot;/local/schema.dtd"&quot;);
} 

Compliant Solution

Two methods, checkPermission(Permission perm) and checkPermission(Permission perm, Object context) were added to the SecurityManager class in J2SE 1.2. The motivations for this change were manifold:

...

Code Block
bgColor#ccccff
SecurityManager sm = System.getSecurityManager();
  
if(sm != null) {  //check if file can be read
  DTDPermission perm = new DTDPermission("&quot;/local/"&quot;,  "readDTD"&quot;readDTD&quot;);
  sm.checkPermission(perm);
}

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

Wiki Markup
\[[API 06|AA. Java References#API 06]\] 

...

FIO36-J. Do not create multiple buffered wrappers on an InputStream      &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;09. Input Output (FIO)      &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;09. Input Output (FIO)