...
| Code Block | ||
|---|---|---|
| ||
public void readSensitiveFile() {
try {
SecurityManager sm = System.getSecurityManager();
if (sm != null) { // Check for permission to read file
sm.checkRead("/temp/tempFile");
}
// Access the file
} catch (SecurityException se) {
// Log exception
}
}
|
Compliant Solution
This compliant solution prevents overriding of the readSensitiveFile() method by declaring it final.
| Code Block | ||
|---|---|---|
| ||
public final void readSensitiveFile() {
try {
SecurityManager sm = System.getSecurityManager();
if (sm != null) { // Check for permission to read file
sm.checkRead("/temp/tempFile");
}
// Access the file
} catch (SecurityException se) {
// Log exception
}
}
|
Compliant Solution
This compliant solution prevents overriding of the readSensitiveFile() method by declaring it private.
| Code Block | ||
|---|---|---|
| ||
private void readSensitiveFile() {
try {
SecurityManager sm = System.getSecurityManager();
if (sm != null) { // Check for permission to read file
sm.checkRead("/temp/tempFile");
}
// Access the file
} catch (SecurityException se) {
// Log exception
}
}
|
Exceptions
MET03-EX0: Classes that are declared final are exempt from this guideline because their member methods cannot be overridden.
...
Failure to declare a non-final class's method private or final affords the opportunity for a malicious subclass to bypass the security checks performed in the methodsmethod.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MET03-J | medium | probable | medium | P8 | L2 |
...