SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 70

changes.mady.by.user Shannon Haas

Saved on

compared with

New Version 71

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

SER02-EX1: Signing and sealing is required only for objects that must cross a trust boundary. Objects that never leave the trust boundary need not be signed or sealed. For instanceexample, when an entire network is contained within a trust boundary, objects that never leave that network need not be signed or sealed. Another example would be objects that are only sent down a signed binary stream.

Risk Assessment

Failure to sign and then seal objects during transit can lead to loss of object integrity or confidentiality.

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="111a9042e9dee43e-a75d7a50-460c4400-864e8521-794ff630dbe35be045e0abc7"><ac:plain-text-body><![CDATA[

[[API 2006

AA. References#API 06]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="bba445157eccc1f3-e8f2e73b-45444152-953aaf75-2877d9ea842c18368ccfa96b"><ac:plain-text-body><![CDATA[

[[Gong 2003

AA. References#Gong 03]]

9.10, Sealing Objects

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="78283d5b743cc551-29335938-4f4d40a7-bd66ad39-696f16c21a2ceae3db98a892"><ac:plain-text-body><![CDATA[

[[Harold 1999

AA. References#Harold 99]]

Chapter 11, Object serialization, sealed objects

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0c341aae4a6e87b6-2661d21d-4a3e4c9c-90d9a78f-f4f65ec0aa1b5f20c33be58b"><ac:plain-text-body><![CDATA[

[[Neward 2004

AA. References#Neward 04]]

Item 64, Use SignedObject to provide integrity of serialized objects

]]></ac:plain-text-body></ac:structured-macro>

 

Item 65, Use SealedObject to provide confidentiality of serializable objects

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="7a7a5f00b7a601c2-4420976a-48b449b6-880a94c7-76783c0e75ea4567fd50b4ec"><ac:plain-text-body><![CDATA[

[[Steel 2005

AA. References#Steel 05]]

Chapter 10, Securing the Business Tier, Obfuscated Transfer Object

]]></ac:plain-text-body></ac:structured-macro>

...