...
Defining a wrapper method facilitates carrying out installing appropriate security manager checks, perform performing input validation before passing the arguments to the native code, defensively copy copying mutable inputs and sanitize sanitizing user supplied input.
Noncompliant Code Example
Security manager checks are not conducted automatically in case of native method invocations. Additionally, as demonstrated in the noncompliant code example, it is easy to overlook proper input validation before the call. The doOperation()
method invokes the nativeOperation()
native method but fails to provide adequate validation. Also, the access specifier of the native method is public
which raises risks associated with untrusted callers.
Code Block | ||
---|---|---|
| ||
public final class NativeMethod { // privatepublic native method public native void nativeOperation(byte[] data, int offset, int len); // wrapper method that does not perform any security checks or input validation public void doOperation(byte[] data, int offset, int len) { nativeOperation(data, offset, len); } static { System.loadLibrary("NativeMethodLib"); // load native library in static initializer of class System.loadLibrary("NativeMethodLib"); } } |
Compliant Solution
This compliant solution makes the actual native method private
and defines a public
wrapper that calls securityManagerCheck()
which in turn performs routine permission checks to determine if the succeeding operations can continue. This is followed by input range checking and the creation of a copy of the mutable input array, data
and input range checking of the parameters. Finally the nativeOperation
method is called with sanitized inputs. Ensure that the validation checks produce outputs that are coherent with the input requirements of the native implementations/libraries.
Code Block | ||
---|---|---|
| ||
public final class NativeMethodWrapper { // private native method private native void nativeOperation(byte[] data, int offset, int len); // wrapper method performs SecurityManager and input validation checks public void doOperation(byte[] data, int offset, int len) { // permission needed to invoke native method securityManagerCheck(); if (data == null) { throw new NullPointerException(); } // copy mutable input data = data.clone(); // validate input if ((offset < 0) || (len < 0) || (offset > (data.length - len))) { throw new IllegalArgumentException(); } nativeOperation(data, offset, len); } static { System.loadLibrary("NativeMethodLib"); // load native library in static initializer of class System.loadLibrary("NativeMethodLib"); } } |
Risk Assessment
Failure to define wrappers around native methods can allow unprivileged callers to invoke them and exploit inherent vulnerabilities such as those resulting from invalid input validation.
...