Page History

A nonfinal class or method that is not meant to be inherited can be overridden by an attacker if it is not declared as {{final}} \[[McGraw 00|java:AA. Java References#McGraw 00]\] Chapter [Seven|http://www.securingjava.com/chapter-seven/chapter-seven-1.html] Rule 3: "Make Everything Final, Unless There's a Good Reason Not To".

If inheritance is to be limited to trusted implementations for a public, nonfinal class, then the class type should be confirmed before creating the instance at each place where an instance of the nonfinal class can be created. A SecurityManager check should be enforced on detecting a subclass (Chapter 6 of \[[Gong 03|java:AA. Java References#Gong 03]\]).

class BankOperation {


//The account balance has already been retrieved from the database and stored in the foll variable
  private Integer balance = 5000;

  public BankOperation() {

    //invoke java.lang.Object.getClass to get class instance
    Class clazz = getClass();
    //shows the class of the instantiated object
    System.out.println(clazz);
  }

  public void getBalance() {
    System.out.println("The current balance is: $" + balance);
  }
}

  //This class has been written by the attacker
  public class SubClass extends BankOperation {

    public void getBalance() {

    //The attacker can change his account balance to any value he wants.
    Integer modifiedBalance = 0;
    //to read the new balance from the attacker
    InputStreamReader input = new InputStreamReader(System.in);
    Field balance=null;
    BufferedReader reader = new BufferedReader(input);
    System.out.print("Enter balance: ");
    try {
          modifiedBalance = Integer.parseInt(reader.readLine());

	  //this gets the private field from the superclass
	  balance = this.getClass().getSuperclass().getDeclaredField("balance");

	  //this changes the accessibility so that field can now be accessed
	  if (!Modifier.isPublic(balance.getModifiers())){
	    balance.setAccessible(true);
	  }
	  //retrieve the original balance
	  System.out.println("Original Balance: $"+balance.get(this));
	  //change the balance
	  balance.set(this, modifiedBalance);
	
	  System.out.println("New Balance: $"+balance.get(this));

    } catch (Exception e) { e.printStackTrace(); } 
  }

  public static void main(String[] args) {
    SubClass subclass = new SubClass();
    subclass.getBalance();
  }
}

final class BankOperation{
//...
}

Preferring static factory methods over {{public}} or {{protected}} constructors also helps limit class extensibility \[[Bloch 08|java:AA. Java References#Bloch 08]\]. Typically, a {{private}} constructor is explicitly provided to override the default no-argument {{public}} constructor.

class BankOperation {
  private BankOperation() {
    // ...
  }
  public static void factoryMethod() {
    // ...
  }
}

class BankOperation {
  private BankOperation() {
    // ...
  }
}

\[[McGraw 00|java:AA. Java References#McGraw 00]\]
\[[Lai 08|java:AA. Java References#Lai 08]\]
\[[SCG 07|java:AA. Java References#SCG 07]\] Guideline 1-2 "Limit the extensibility of classes and methods"
\[[Gong 03|java:AA. Java References#Gong 03]\]
\[[Bloch 08|java:AA. Java References#Bloch 08]\] Item 1: "Consider static factory methods instead of constructors"