Page History

Invocation of System.exit() terminates the Java Virtual Machine (JVM), consequently terminating all running programs and threads running thereon. This can result in denial-of-service (DoS) attacks. For example, a call to System.exit() that is embedded in Java Server Pages (JSP) code can cause a web server to terminate, preventing further service for users. Programs must prevent both inadvertent and malicious calls to System.exit(). Additionally, programs should perform necessary clean-up cleanup actions when forcibly terminated (for example, by using the Windows Task Manager, POSIX kill command, or other mechanism).

...

Code Block

bgColor	#ccccff

class PasswordSecurityManager extends SecurityManager {
  private boolean isExitAllowedFlag; 
  
  public PasswordSecurityManager(){
    super();
    isExitAllowedFlag = false;  
  }
 
  public boolean isExitAllowed(){
    return isExitAllowedFlag;	 
  }
 
  @Override public void checkExit(int status) {
    if (!isExitAllowed()) {
      throw new SecurityException();
    }
    super.checkExit(status);
  }
 
  public void setExitAllowed(boolean f) {
    isExitAllowedFlag = f; 	 
  }
}

public class InterceptExit {
  public static void main(String[] args) {
    PasswordSecurityManager secManager =
        new PasswordSecurityManager();
    System.setSecurityManager(secManager);
    try {
      // ...
      System.exit(1);  // Abrupt exit call
    } catch (Throwable x) {
      if (x instanceof SecurityException) {
        System.out.println("Intercepted System.exit()");
        // Log exception
      } else {
        // Forward to exception handler
      }
    }

    // ...
    secManager.setExitAllowed(true);  // Permit exit
    // System.exit() will work subsequently
    // ...
  }
}

This implementation uses an internal flag to track whether the exit is permitted. The method setExitAllowed() sets this flag. The checkExit() method throws a SecurityException when the flag is unset (e.g.that is, false). Consequently, normal exception processing bypasses the initial call to System.exit(). The program catches the SecurityException and performs mandatory clean-up cleanup operations, including logging the exception. The setExitAllowed() method is invoked only after clean-up cleanup is complete. Consequently, the program exits gracefully.

Exceptions

Wiki Markup

*EXC09ERR09-EX0:* It is permissible for a command -line utility to call {{System.exit()}} or terminate prematurely;, forsuch example,as when the required number of arguments are not input \[[Bloch 2008|AA. Bibliography#Bloch 08]\], and \[[ESA 2005|AA. Bibliography#ESA 05]\].

...

Allowing inadvertent calls to System.exit() may lead to denial of service (DoS).

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
ERR09-J	low	unlikely	medium	P2	L3

Related Guidelines

MITRE CWE

CWE-382, "J2EE Bad Practices. J2EE bad practices: Use of System.exit()"

Bibliography

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c8152f1ce0e7639a-4fef489e-466d43a5-9bca8755-8a91bec7f1d4b026df48c5df"><ac:plain-text-body><![CDATA[	[[API 2006	AA. Bibliography#API 06]]	[method Method `checkExit()`	http://java.sun.com/j2se/1.4.2/docs/api/java/lang/SecurityManager.html#checkExit(int)], Class class `Runtime`, method `addShutdownHook`	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f0a4bba297d2fb83-1f19258b-4a2f4831-83fca956-1c35106e7aaf6d64dce327a7"><ac:plain-text-body><![CDATA[	[[Austin 2000	AA. Bibliography#Austin 00]]	[Writing a Security Manager	http://java.sun.com/developer/onlineTraining/Programming/JDCBook/signed2.html]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f45abb9754193225-ca0117b6-4c7f4830-b4839fba-ee780a32cf56238ed826a0ca"><ac:plain-text-body><![CDATA[	[[Darwin 2004	AA. Bibliography#Darwin 04]]	9.5, The Finalize Method	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="abdbe2e9db8ae0fc-0b46813a-4fac4b02-b2509c9c-3131c95f88d21673b50e4540"><ac:plain-text-body><![CDATA[	[[ESA 2005	AA. Bibliography#ESA 05]]	Rule 78: . Restrict the use of the `System.exit` method	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f867918bf0c89a59-57274973-42b4484a-9c9b9605-3b4f6c2584872bd36816bbdc"><ac:plain-text-body><![CDATA[	[[Goetz 2006	AA. Bibliography#Goetz 06]]	7.4. , JVM Shutdown	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="01ea7409e6771918-fa43ee5e-413e463b-b213b701-f7c81263d0044c8abdc54faf"><ac:plain-text-body><![CDATA[	[[Kalinovsky 2004	AA. Bibliography#Kalinovsky 04]]	Chapter 16, Intercepting a Call to `System.exit`	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 66

New Version 67

Key

Exceptions

Related Guidelines

Bibliography