...

Note that this rule makes no assumptions about the integrity of the data being sent down a socket. For information about ensuring data integrity, see SER02-J. Sign then seal sensitive objects before sending them outside a trust boundary.

Noncompliant Code Example

This example shows the use of regular sockets for a server application that does not protect sensitive information in transit. The insecure code for the corresponding client application follows the server's code.

...

Note that the sockets are closed in accordance with ERR05-J. Do not let checked exceptions escape from a finally block. While merely printing close exceptions is frowned upon, the exceptions may be suppressed as per ERR00-EX0 of ERR00-J. Do not suppress or ignore checked exceptions.

Compliant Solution

This compliant solution makes use of SSLSockets to protect packets using the SSL/TLS security protocols.

...

Note that a program that makes use of SSLSockets will block indefinitely if it tries to connect to a port that is not using SSL. Similarly, a program that does not use SSLSockets will block when trying to establish a connection through a port that uses SSL.

Exceptions

MSC00-EX0: Because of the mechanisms that SSLSockets provide to ensure the secure transfer of packets, significant performance overhead may result. Regular sockets are sufficient if

• the data being sent over the socket is not sensitive
• the data is sensitive, but properly encrypted. See SER02-J. Sign then seal sensitive objects before sending them outside a trust boundary for more information.
• the network path of the socket never crosses a trust boundary. This could happen if, for example, the two endpoings of the socket are within a local network and the entire network is trusted.

Risk Assessment

Using plain sockets instead of SSLSockets means that the data's confidentiality and integrity is not guaranteed.

Automated Detection

The general case of automated detection appears to be infeasible because determining which specific data may be passed through the socket is not statically computable. An approach that introduces a custom API for passing sensitive data via secure sockets may be feasible. User tagging of sensitive data would be a necessary requirement for such an approach.

Related Guidelines

Bibliography

...