Instances from the class The javax.net.ssl.SSLSocket class must be created used instead of normal Sockets the java.net.Socket socket class when transferring sensitive objects data over insecure communication channels. The class SSLSockets provides security protocols such as SSL or /TLS to ensure that the channel is not open vulnerable to eavesdropping and malicious tampering.

...

Wiki Markup

It is also important to use SSL for secure Remote Method Invocation (RMI) communications because RMI depends on object serialization and serialized data must be safeguarded in transit. Gong et al. \[[Gong 03|AA. Java References#Gong 03]\] describe how to secure RMI communications using {{SSLSockets}}.

...

This example shows the use of regular sockets for a server application that does not protect sensitive information in transit. The insecure code for the corresponding client application follows the server's code.

Code Block

bgColor	#FFCCCC

  
// Exception handling has been omitted for the sake of brevity
class EchoServer { 
  public static void main(String[] args) { 
    trythrows IOException { 
      ServerSocket serverSocket = new ServerSocket(10007); 
      Socket socket = serverSocket.accept();
			
      PrintWriter out = new PrintWriter(socket.getOutputStream(), true); 
      BufferedReader in = new BufferedReader(
          new InputStreamReader( socket.getInputStream())); 

      String inputLine; 

      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
        out.println(inputLine); 
      } 

      out.close(); 
    //  in.close(); 
out, in,     socket.close();  
    }
    catch (Exception e) { /*Handle exception*/ }   socket (preferably in a try-finally block)   
  }
}

class EchoClient {
  public static void main(String[] args) {
throws IOException   try{ {
      Socket socket = new Socket("localhost", 9999);
						
      PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(
          new InputStreamReader(socket.getInputStream()));

      BufferedReader stdIn = new BufferedReader(
          new InputStreamReader(System.in));
			
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	      System.out.println(in.readLine());
     } }

    // close out.close();
      in.close();
      stdIn.close();
      socket.close();
    }
    catch (Exception e) { /*Handle exception*/ } , in, stdIn, socket (preferably in a try-finally block)   
  }
}

Compliant solution

This compliant solution makes use of SSLSockets to protect packets using the SSL and /TLS security protocols.

Code Block

bgColor	#CCCCFF


// Exception handling has been omitted for the sake of brevity
class EchoServer {
  public static void main(String[] args) {
throws IOException {  try {
      SSLServerSocketFactory sslserversocketfactory =
          (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
      SSLServerSocket sslserversocket =
          (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
      SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

      PrintWriter out = new PrintWriter( sslsocket.getOutputStream(),true);
      BufferedReader in = new BufferedReader(
          new InputStreamReader( sslsocket.getInputStream()));
            
      String inputLine; 
            
      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
	      out.println(inputLine); 
      } 
			
    // close out.close(); 
      in.close(); 
      sslsocket.close(); 
    } 
    catch (Exception e) { /*Handle exception*/ } , in, sslsocket (preferably in a try-finally block)
  }
}

class EchoClient {
  public static void main(String[] args) {
    trythrows IOException {
      SSLSocketFactory sslsocketfactory =
          (SSLSocketFactory) SSLSocketFactory.getDefault();
      SSLSocket sslsocket =
          (SSLSocket) sslsocketfactory.createSocket("localhost", 9999);

      PrintWriter out = new PrintWriter(sslsocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(
          new InputStreamReader(sslsocket.getInputStream()));
			
      BufferedReader stdIn = new BufferedReader(
          new InputStreamReader(System.in));
            
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	      System.out.println(in.readLine());
      }

      out.close();
     // in.close();
 out, in,    stdIn.close();
      sslsocket.close();		
    } 
    catch (Exception e) { /*Handle exception*/ } stdIn, sslsocket (preferably in a try-finally block)
  }
}

Note that a program that makes use of SSLSockets will block indefinitely if it tries to connect to a port that is not using SSL and, similarly. Similarly, a program that does not use SSLSockets will block when trying to establish a connection through a port that uses SSL.

...

Using plain sockets instead of SSLSockets means that the data's confidentiality and integrity is not protectedguaranteed.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
SEC09- J	medium	likely	high	P6	L2

...

Space shortcuts

Page tree

Versions Compared

Old Version 25

New Version 26

Key

Compliant solution

Space shortcuts

Page tree

Page History

Versions Compared

Old Version 25

New Version 26

Key

Compliant solution