Page History

A non-final class or method that is not meant to be inherited can be overridden by an attacker if it is not declared final. Sometimes, only trusted implementations should be allowed to extend the class. Because declaring the class final is overly prohibitive in such cases, it must be carefully designed Some classes ("parent classes" hereafter) must permit extension by trusted subclasses while simultaneously preventing extension by untrusted code. Declaring such parent classes to be final is overly prohibitive, because it would prevent all extension and overriding. This case requires careful design for inheritance.

Consider two classes belonging to different protection domains.; One ofone them is malicious whereas, the other is a trusted parent class. IfWhen the malicious class extends the trusted {{public}} non-final parent class and inherits without overriding asome method of the trusted class, thea fully qualified invocation of the malicious class's version of the method uses the protection domain of the trusted parent class. In this caseConsequently, the trusted parent class's permissions are examined to execute the method \[[Gong 2003|AA. Bibliography#Gong 03]\].

One suggestion is that at all commonly suggested (but ineffective) solution is to place code at each points where the parent class can be instantiated , there must be checks to ensure that the instance being created has the same type as the parent class. If When the type is found to be that of a subclass instead of the non-final public superclassparent class's type, the checking code performs a security manager check can be performed to ensure that malicious classes cannot misuse the parent class. This approach is insecure because it allows a malicious class to add a finalizer and obtain a partially initialized instance of the parent class . (See see guideline OBJ04-J. Do not allow access to partially initialized objects). ) For non-final classes, the method that performs the security manager check must be passed invoked as an argument to a private constructor so that Object's constructor does not exit before to ensure that the security check is performed before any superclass's constructor can exit.

The use of reflection is necessary to exploit the non-final class if it When the parent class has members that are declared private or are otherwise inaccessible to the attacker, the attacker must use reflection to exploit those members of the parent class. Declaring the parent class or its methods final prohibits this level of access.

Noncompliant Code Example

In this noncompliant code example, a malicious class can extend the public non-final parent class, NonFinal. As a result, it can call any of its Consequently, the attacker can invoke any of the parent class's accessible instance methods and can access its the parent class's protected fields.

public class NonFinal {
  public NonFinal() {
    // ...   
  }
}

Noncompliant Code Example

This noncompliant code example installs a security manager check in the constructor of the non-final parent class. AccessThe issecurity deniedmanager ifdenies theaccess securitywhen managerit detects that a subclass without the requisite permissions, is tryingattempting to instantiate the superclass \[[SCG 2007|AA. Bibliography#SCG 07]\].

...

However, throwing an exception from the constructor is of a non-final class is insecure because it allows a finalizer attack . (See see guideline OBJ04-J. Do not allow access to partially initialized objects).)

This noncompliant code example complies does, however, comply with guideline OBJ06-J. Compare classes and not class names because it compares class types and not class names.

Compliant Solution

Irrespective of whether it is a trusted instance or an untrusted one, install This compliant solution invokes a security manager check using the technique described as a side-effect of computing the boolean value passed to a private constructor (as seen in guideline OBJ04-J. Do not allow access to partially initialized objects). The rules for order of evaluation require that the security manager check must execute before invocation of the private constructor. Consequently, the security manager check also executes before invocation of any superclass's constructor. Note that the security manager check is made without regard to whether the object under construction has the type of the parent class or the type of a subclass (whether trusted or not).

public class NonFinal {
  public NonFinal() {
    this(securityManagerCheck()); // throws a security exception if not allowed
    // ...
  }
  
  private NonFinal(boolean securityManagerCheck) {
    // No statements required	  
  }

  private static boolean securityManagerCheck() {
    // Perform security check	  
  }
}

Risk Assessment

Allowing a non-final class or method to be inherited without checking the class instance allows a malicious subclass to misuse the privileges of the class.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

\[[McGrawBloch 20002008|AA. Bibliography#McGrawBibliography#Bloch 0008]\] Chapter Seven Rule 3: "Make Everything Final, Unless There's a Good Reason Not To Item 1: "Consider static factory methods instead of constructors"
\[[Gong 2003|AA. Bibliography#Gong 03]\] Chapter 6: "Enforcing Security Policy"
\[[Lai 2008|AA. Bibliography#Lai 08]\]
\[[SCGMcGraw 20072000|AA. Bibliography#SCGBibliography#McGraw 0700]\] GuidelineChapter 1-2 "Limit the extensibility of classes and methods"
\[[Gong 2003|AA. Bibliography#Gong 03]\] Chapter 6: "Enforcing Security Policy"
\[[Bloch 2008|AA. Bibliography#Bloch 08]\] Item 1: "Consider static factory methods instead of constructorsSeven Rule 3: "Make Everything Final, Unless There's a Good Reason Not To"\[[SCG 2007|AA. Bibliography#SCG 07]\] Guideline 1-2 "Limit the extensibility of classes and methods"

...

OBJ04-J. Do not allow access to partially initialized objects      08. Object Orientation (OBJ)      OBJ06-J. Compare classes and not class names