Page History

...

Defining a wrapper method facilitates installing appropriate security manager checks, performing input validation before passing the arguments to the native code or when obtaining return values, defensively copying mutable inputs and sanitizing user input. Therefore every native method must be private, and be invoked only by a wrapper method.

Noncompliant Code Example

In this noncompliant code example, the nativeOperation is both native and public; hence untrusted callers may invoke it. Native method invocations bypass security manager checks.

The example does include a wrapper; the Additionally, as demonstrated in this noncompliant code example, it is easy to overlook proper input validation before the native method invocation. The doOperation() method invokes the nativeOperation() native method but fails to provide adequate input validation . Further, untrusted callers can invoke the native method because its access specifier is publicor security checks.

public final class NativeMethod {

  // public native method
  public native void nativeOperation(byte[] data, int offset, int len);

  // wrapper method that lacks security checks and input validation
  public void doOperation(byte[] data, int offset, int len) {
    nativeOperation(data, offset, len);
  }
  
  static {
    // load native library in static initializer of class
    System.loadLibrary("NativeMethodLib"); 
  }
}

...

This compliant solution declares the native method private and defines a public wrapper that calls the securityManagerCheck() method. The . Furthermore, the doOperation() wrapper method performs routine permission checking to determine whether the succeeding operations are permitted to continue. This is followed by the creation of a defensive copy of the mutable input array data as well as by range checking of the parameters. The nativeOperation() method is thus called with safe inputs. Note that the validation checks must produce outputs that conform to the input requirements of the native implementations/libraries.

...

\[[Fairbanks 2007|AA. Bibliography#Fairbanks 07]\]
\[[JNI 2006|AA. Bibliography#JNI 06]\]
\[[Liang 1997|AA. Bibliography#Liang 97]\]
\[[Macgregor 1998|AA. Bibliography#Macgregor 98]\] Section 2.2.3, Interfaces and Architectures

\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 111|http://cwe.mitre.org/data/definitions/111.html] "Direct Use of Unsafe JNI"
\[[SCG 2007|AA. Bibliography#SCG 07]\] Guideline 3-3 Define wrappers around native methods

...