Page History

...

This compliant solution both explicitly hard codes the name of the file and confines the variables used in the privileged block to the same methoddeclares the variable as static final to prevent it from being modified. This ensures that no malicious file can be loaded by exploiting the privileged method.

Code Block

bgColor	#ccccff

static final String FILEPATH = "/path/to/protected/file/fn.ext";

private void privilegedMethod() throws FileNotFoundException {
  try {
    FileInputStream fis =
        (FileInputStream) AccessController.doPrivileged(
            new PrivilegedExceptionAction() {
        public FileInputStream run() throws FileNotFoundException {
          return new FileInputStream(FILEPATH);
        }
      }
    );
    // do something with the file and then close it
  } catch (PrivilegedActionException e) {
    // forward to handler and log
  }
}

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a9787b06f36501f3-720a5c0b-4e4549d6-96429df2-f3383ffaad38fcc789f340e4"><ac:plain-text-body><![CDATA[	[[API 2006	AA. References#API 06]]	[Method `doPrivileged()`	http://java.sun.com/javase/6/docs/api/java/security/AccessController.html#doPrivileged(java.security.PrivilegedAction)]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="ce9142dc9ae4c979-0f088110-42cd44a0-b0bead4b-a82286d730f29e333acb79cd"><ac:plain-text-body><![CDATA[	[[Gong 2003	AA. References#Gong 03]]	Sections 6.4, `AccessController`, and 9.5, Privileged Code	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="8ea518170f6a0ea3-525b12e6-47a84f68-8c1b8202-4fde895d63ae0244dee06db1"><ac:plain-text-body><![CDATA[	[[Jovanovic 2006	AA. References#Jovanovic 06]]	Pixy: A Static Analysis Tool for Detecting Web Application Vulnerabilities	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 79

New Version 80

Key