The write() method defined in java.io.OutputStream takes an integer argument intended to be between 0 and 255. Because an int is otherwise designed to store 4 byte numbers, failure to range check may lead to unexpected results.
| Wiki Markup |
|---|
The general contract for the {{write()}} method says that one byte is written to the output stream. The byte to be written constitutes the eight lower order bits of the argument {{b}}, passed to the {{write()}} method. The 24 high-order bits of {{b}} are ignored. \[[API 06|AA. Java References#API 06]\] |
Noncompliant Code Example
The noncompliant code example accepts a value from the user without validating it. Any value with greater than eight bits is truncated. For instance, write(303) prints / because the lower order bits of 303 are preserved while the top 24 order bits are lost (303 mod 256 is 47 and / has ASCII code 47). That is, the result is remainder modulo 256 of the absolute value of the input.
| Code Block | ||
|---|---|---|
| ||
class ConsoleWrite {
public static void main(String[] args) {
//Any input value > 255 will result in unexpected output
System.out.write(Integer.valueOf(args[0].toString()));
System.out.flush();
}
}
|
Compliant Solution
Use alternative means to output integers such as the System.out.print* methods.
| Code Block | ||
|---|---|---|
| ||
class ConsoleWrite {
public static void main(String[] args) {
System.out.println(args[0]);
}
}
|
Compliant Solution (2)
Alternatively, perform range checking to be compliant. While this particular solution still does not display the integer correctly, it behaves well when the corresponding read method is used to convert the byte back to an integer.
| Code Block | ||
|---|---|---|
| ||
class FileWrite {
public static void main(String[] args) throws NumberFormatException, IOException {
FileOutputStream out = new FileOutputStream("output.txt");
//Perform range checking
if(Integer.valueOf(args[0]) >= 0 && Integer.valueOf(args[0]) <= 255) {
out.write(Integer.valueOf(args[0].toString()));
System.out.flush();
}
else {
//handle error
throw new ArithmeticException("Value is out of range");
}
}
}
|
Compliant Solution (3)
In this compliant solution, the writeInt() method of the DataOutputStream class is used.
| Code Block | ||
|---|---|---|
| ||
class FileWrite {
public static void main(String[] args) throws NumberFormatException, IOException {
FileOutputStream out = new FileOutputStream("output.txt");
DataOutputStream dos = new DataOutputStream(out);
dos.writeInt(Integer.valueOf(args[0].toString()));
dos.close();
out.close();
}
}
|
Risk Assessment
Using the write() method to output integers may result in unexpected values.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
INT31- J | low | unlikely | medium | P2 | L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] method [write()|http://java.sun.com/javase/6/docs/api/java/io/OutputStream.html#write(int)] \[[Harold 99|AA. Java References#Harold 99]\] |
INT30-J. Range check when casting integers to narrower types 05. Integers (INT) VOID INT32-J. Perform conversion from BigInteger to String and back properly