...
| Code Block | ||
|---|---|---|
| ||
public class Point {
private double x;
private double y;
public Point(double x, double y) {
this.x = x;
this.y = y;
}
public Point() {
// no-argument constructor
}
}
public class Coordinates extends Point implements Serializable {
public static void main(String[] args) {
FileOutputStream fout = null;
try {
Point p = new Point(5, 2);
fout = new FileOutputStream("point.ser");
ObjectOutputStream oout = new ObjectOutputStream(fout);
oout.writeObject(p);
} catch (Throwable t) {
// Forward to handler
} finally {
if (fout != null) {
try {
fout.close();
} catch (IOException x) {
// handle error
}
}
}
}
}
|
...
In the absence of sensitive data, classes can be serialized by simply implementing the java.io.Serializable interface. By doing so, the class indicates that no security issues may result from the object's serialization. Note that any derived subclasses also inherit this interface and are consequently serializable. This approach is inappropriate for any class that contains sensitive data.
Compliant Solution
When serializing a class that contains sensitive data, programs must ensure that sensitive data is omitted from the serialized form. This includes suppressing both serialization of data members that contain sensitive data and serialization of references to non-serializable or sensitive objects.
...
See rule MSC07-J. Prevent multiple instantiations of singleton objects for more information on singletonsabout singleton classes.
Compliant Solution
Extending a class or interface that implements Serializable should be avoided whenever possible. When extension of such a class is necessary, inappropriate serialization of the subclass can be prohibited by throwing NotSerializableException from a custom writeObject() or readResolve() method, defined in the subclass SensitiveClass. Note that the custom writeObject() or readResolve() methods must be declared final to prevent a malicious subclass from overriding them.
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0ad13dd3d8202acd-34f3d63a-49294d4a-b17b9ccc-4e8a045334c28f4ff0ce3e5c"><ac:plain-text-body><![CDATA[ | [[Bloch 2005 | AA. Bibliography#Bloch 05]] | Puzzle 83. Dyslexic monotheism | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e3c18be2004e7995-d5654561-48a94229-9c1db0a7-a768e60581a46e6efad15a73"><ac:plain-text-body><![CDATA[ | [[Bloch 2001 | AA. Bibliography#Bloch 01]] | Item 1. Enforce the singleton property with a private constructor | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e9da426eb59808b5-e7686582-47ff4da8-89eea973-baca090400d2db854ebf8fbd"><ac:plain-text-body><![CDATA[ | [[Greanier 2000 | AA. Bibliography#Greanier 00]] | [Discover the Secrets of the Java Serialization API | http://java.sun.com/developer/technicalArticles/Programming/serialization/] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2feec520fba1a86b-1dd83a3d-436d4d57-afbcba05-9f1e0207a2e9a38cdd665f1e"><ac:plain-text-body><![CDATA[ | [[Harold 1999 | AA. Bibliography#Harold 99]] |
| ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a34b33e69c3a3789-2a45a2fa-49694bfc-a4e08c9c-a8d23990ded9fe5322ea3db4"><ac:plain-text-body><![CDATA[ | [[JLS 2005 | AA. Bibliography#JLS 05]] | [Transient Modifier | http://java.sun.com/docs/books/jls/third_edition/html/classes.html#37020] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e689e5034272cbf0-f6fc45fa-43a142c3-95e9b58e-63d1000d66cadb94bb13999a"><ac:plain-text-body><![CDATA[ | [[Long 2005 | AA. Bibliography#Long 05]] | Section 2.4, Serialization | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b6d21a818069469d-1ef645bf-46ab499c-8c1c9330-954140f1fb9fa6027f37b58c"><ac:plain-text-body><![CDATA[ | [[Sun 2006 | AA. Bibliography#Sun 06]] | Serialization Specification, A.4, Preventing Serialization of Sensitive Data | ]]></ac:plain-text-body></ac:structured-macro> |
...