...
| Wiki Markup |
|---|
For instance, the introduction of the {{entrySet()}} method in the superclass {{java.util.Hashtable}} in JDK 1.2 left the {{java.security.Provider}} class vulnerable to a security attack. The class {{java.security.Provider}} extends {{java.util.Properties}} which in turn extends {{java.util.Hashtable}}. {{Provider}}, inherits the {{put()}} and {{remove()}} methods from {{Hashtable}} and adds security manager checks to each. The {{Provider}} maps a cryptographic algorithm name (for example, RSA) to a class that provides its implementation. The security manager checks ensure that malicious code cannot add or remove the mappings. When {{entrySet()}} was introduced, it became possible for untrusted code to remove the mappings from the {{Hashtable}} because {{java.security.Provider}} did not override this method to provide the necessary security manager check \[[SCG 07|AA. Java References#SCG 07]\]. This problem is commonly know as a "fragile class hierarchy" in C++. |
Noncompliant Code Example
This noncompliant code example shows a class SuperClass that stores banking related information but delegates the security manager and input validation tasks to the class SubClass. The client application is required to use SubClass as it contains various authentication mechanisms. A new method called overdraft is added by the maintainer of the class SuperClass and the extending class SubClass is not aware of this change. This exposes the client application to malicious invocations. One such example is of the overdraft method being used on the currently in-use object. All security checks are deemed useless in this case.
| Code Block | ||
|---|---|---|
| ||
class SuperClass { // The bank SuperClass class maintains all bank data during program execution
private double balance = 0;
protected boolean withdraw(double amount) {
balance -= amount;
return true;
}
protected void overdraft() { // this method is added at a later date
balance += 300; // add 300 in case there is an overdraft
System.out.println("The balance is :" + balance);
}
}
class SubClass extends SuperClass { //all users have to subclass this to proceed
public boolean withdraw(double amount) {
// inputValidation();
// securityManagerCheck();
// Login by checking credentials using database and then call a method in SuperClass
// that updates the balance field to reflect current balance, other details
return true;
}
public void doLogic(SuperClass sc,double amount) {
sc.withdraw(amount);
}
}
public class Affect {
public static void main(String[] args) {
SuperClass sc = new SubClass(); //override Override
SubClass sub = new SubClass(); //need Need instance of SubClass to call methods
if(sc.withdraw(200.0)) { // validateValidate and enforce security manager check
sc = new SuperClass(); // ifIf allowed perform the withdrawal
sub.doLogic(sc, 200.0); // passPass the instance of SuperClass to use it
}
else
System.out.println("You do not have permission/input validation failed!");
sc.overdraft(); // newlyNewly added method, has no security manager checks. Beware!
}
}
|
Compliant Solution
Always keep the following postulates in mind:
This compliant solution is the same as the noncompliant code example, except that it overrides the overdraft() method and throws an exception to prevent misuse of the overdraft feature.
| Code Block | ||
|---|---|---|
| ||
class SubClass extends SuperClass {
// ...
protected void overdraft() { // override
throw new IllegalAccessException();
}
}
}
}
|
Alternatively, install a security manager check in the overridden method if it should be allowable to use it from a subclass.
Noncompliant Code Example
This noncompliant code example overrides the methods after() and compareTo() of the class java.util.Calendar. The Calendar.after() method returns a boolean value depending on whether the Calendar represents a time after the time represented by the specified Object parameter. The programmer wishes to extend this functionality and return true even when the two objects are equal. Note that compareTo() is also overridden in this example, to provide a "comparisons by day" option to clients. For example, comparing today's day with the first day of week (which differs from country to country) to check whether it is a weekday.
...
| Code Block | ||
|---|---|---|
| ||
class CalendarSubclass extends Calendar {
@Override public boolean after(Object when) {
if(when instanceof Calendar && super.compareTo((Calendar)when) == 0) {
// correctly calls Calendar.compareTo()
return true;
}
return super.after(when); // callsCalls CalendarSubclass.compareTo() instead of Calendar.compareTo()
}
@Override public int compareTo(Calendar anotherCalendar) {
// This method is erroneously invoked by Calendar.after()
return compareTo(anotherCalendar.getFirstDayOfWeek(), anotherCalendar);
}
private int compareTo(int firstDayOfWeek, Calendar c) {
int thisTime = c.get(Calendar.DAY_OF_WEEK);
return (thisTime > firstDayOfWeek) ? 1 : (thisTime == firstDayOfWeek) ? 0 : -1;
}
public static void main(String[] args) {
CalendarSubclass cs1 = new CalendarSubclass();
CalendarSubclass cs2 = new CalendarSubclass();
cs1.setTime(new Date());
System.out.println(cs1.after(cs2)); // prints false
}
// Implementation of other abstract methods
}
// The implementation of java.util.Calendar.after() method is shown below
public boolean after(Object when) {
return when instanceof Calendar && compareTo((Calendar)when) > 0;
// forwards to the subclass's implementation erroneously
}
|
...
| Code Block | ||
|---|---|---|
| ||
// The CalendarImplementation object is a concrete implementation of the abstract Calendar class
// Class ForwardingCalendar
public class ForwardingCalendar {
private final CalendarImplementation c;
public ForwardingCalendar(CalendarImplementation c) {
this.c = c;
}
public boolean after(Object when) {
return c.after(when);
}
public int compareTo(Calendar anotherCalendar) {
// ForwardingCalendar's compareTo() will be called
return c.compareTo(anotherCalendar);
}
}
//Class CompositeCalendar
class CompositeCalendar extends ForwardingCalendar {
public CompositeCalendar(CalendarImplementation ci) {
super(ci);
}
@Override public boolean after(Object when) {
if(when instanceof Calendar && super.compareTo((Calendar)when) == 0) {
// this will call the overridden version
// i.e. CompositeClass.compareTo();
// return true if it is the first day of week
return true;
}
return super.after(when); // does not compare with first day of week anymore;
// uses default comparison with epoch
}
@Override public int compareTo(Calendar anotherCalendar) {
// CompositeCalendarcompareTo() will not be called now
return compareTo(anotherCalendar.getFirstDayOfWeek(),anotherCalendar);
}
private int compareTo(int firstDayOfWeek, Calendar c) {
int thisTime = c.get(Calendar.DAY_OF_WEEK);
return (thisTime > firstDayOfWeek) ? 1 : (thisTime == firstDayOfWeek) ? 0 : -1;
}
public static void main(String[] args) {
CalendarImplementation ci1 = new CalendarImplementation();
CalendarImplementation ci2 = new CalendarImplementation();
CompositeCalendar c = new CompositeCalendar(ci1);
ci1.setTime(new Date());
System.out.println(c.after(ci2)); // prints true
}
}
|
...
Modifying a superclass without considering the effect on a subclass can introduce vulnerabilities. Subclasses that are unaware of the superclass implementations implementation can be subject to erratic behavior resulting in inconsistent data state and mismanaged control flow.
...