Page History

The write() method that is defined in java.io.OutputStream, takes an integer argument intended to be between 0 and 255. Because an int is otherwise designed to store 4 byte numbers, failure to validate user input range check may lead to unexpected results.

The general contract for the {{write is()}} method says that one byte is written to the output stream. The byte to be written isconstitutes the eight lower low-order bits of the argument {{b}}, passed to the {{write()}} method. The 24 high-order bits of {{b}} are ignored. \[[API 06|AA. Java References#API 06]\]

Noncompliant Code Example

The noncompliant code example accepts a value from the user without validating it. Any value with greater than eight bits will be is truncated. For instance, write(303) will print '/' since prints / because the lower order bits of 303 are preserved while the top 24 order bits are lost (303 mod 256 is 47 and '/' has ASCII code 47). That is, the result is remainder modulo 256 of the absolute value of the input.

class ConsoleWrite {
  public static void main(String[] args) { 
    //Any input value > 255 will result in unexpected output
    System.out.write(Integer.valueOf(args[0].toString()));
    System.out.flush();
  }
}

Compliant Solution

Use alternative means to output integers such as the System.out.print* methods.

class ConsoleWrite {
  public static void main(String[] args) { 
    System.out.println(args[0]);
  }
}

Compliant Solution (2)

Alternatively, perform input validationrange checking to be compliant. While this particular solution will still does not display the integer correctly, it will behave behaves well when the corresponding read method is utilized used to convert the byte back to an integer.

class FileWrite {
  public static void main(String[] args) throws NumberFormatException, IOException { 
    FileOutputStream  out = new FileOutputStream("output.txt");   
    //Perform inputrange validationchecking
    if(Integer.valueOf(args[0]) >= 0 && Integer.valueOf(args[0]) <= 255) {
      out.write(Integer.valueOf(args[0].toString()));
      System.out.flush();
    }
    else {
      //handle error 
      throw new ArithmeticException("Value is out of range");
    } 
  }
}

Compliant Solution (3)

Similarly, if it is required to write a larger integer value, In this compliant solution, the writeInt() method of the DataOutputStream class can be used. Again, the output should not be used without appropriately escaping or encoding itis used.

class FileWrite {
    public static void main(String[] args) throws NumberFormatException, IOException { 
    FileOutputStream  out = new FileOutputStream("output.txt");   
    DataOutputStream dos = new DataOutputStream(out);
    dos.writeInt(Integer.valueOf(args[0].toString()));
    dos.close();
    out.close();
  }     
}

Risk Assessment

Using the write() method to output integers may result in unexpected values.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[API 06|AA. Java References#API 06]\] method [write()|http://java.sun.com/javase/6/docs/api/java/io/OutputStream.html#write(int)]
\[[Harold 99|AA. Java References#Harold 99]\]

...