A non-final class or method that is not meant to be inherited can be overridden by an attacker if it is not declared final. Sometimes, only trusted implementations should be allowed to extend the class. Declaring Because declaring the class final is overly prohibitive and in such cases, the class it must be carefully designed for inheritance.
| Wiki Markup |
|---|
A related pitfall occurs when malicious classes are allowed to extend from a non-final class. Consider two classes belonging to different protection domains. One of them is malicious whereas the other is trusted. If the malicious class extends the trusted {{public}} non-final class and inherits without overriding a method of the trusted class, the fully qualified invocation of the malicious class's version of the method uses the protection domain of the trusted class. In this case, the trusted class's permissions are examined to execute the method. \[[Gong 03|java:AA. Java References#Gong 03]\]) |
...
| Wiki Markup |
|---|
This compliant solution installs a security manager check in the constructor of the non-final class. Access is denied if the security manager detects that a subclass without the requisite permissions, is trying to instantiate the superclass without the requisite permissions. \[[SCG 07|java:AA. Java References#SCG 07]\] |
| Code Block |
|---|
|
public class NonFinal {
public NonFinal() {
// invokeInvoke java.lang.Object.getClass to get class instance
Class c = getClass();
// confirmConfirm class type
if (c != NonFinal.class) {
// checkCheck the permission needed to subclass NonFinal
securityManagerCheck(); // throws a security exception if not allowed
}
// ...
}
}
|
...
