Page History

...

This noncompliant code example creates multiple BufferedInputStreams on System.in. Although it will work when System.in refers to a console, it crashes when System.in has been redirected to a file. , because each time getChar() is called it makes a new BufferedInputStream. Note that it does not matter the old BufferedInputStream will have "expired" by the time the new one is created. Note that while this code uses a BufferedInputStream to illustrate that any buffered wrapper is unsafe, it is also exploitable if a Scanner is used instead.

Implementation Details

This program was compiled with the command javac InputLibrary.java on a system with Java 1.5.0. When run from the command line with java InputLibrary, the program will successfully take two characters as input and print them out. However, when run with java InputLibrary < input, where input is a file that contains the exact same input, the program throws an IOException because the second call to getChar() finds no characters to read.

import java.io.BufferedInputStream;
import java.io.IOException;

public final class InputLibrary{

  public static char getChar()throws IOException {
    BufferedInputStream in = new BufferedInputStream(System.in);
    int input = in.read();
    if(input==-1){
    	throw new IOException();
    }
    return (char)input;
  }

  public static void main(String[] args)throws IOException {
    System.out.print("Enter first initial: ");
    char first=getChar();
    System.out.println("Your first initial is "+first);
    System.out.print("Enter last initial: ");
    char last=getChar();
    System.out.println("Your last initial is "+last);
  }
}

...

Create and use only a single BufferedInputStream on System.in. This code example stores the BufferedInputStream as a class variable so all methods can access it. However, if a program were to use this library in conjunction with other input from a user that also needs some buffered wrapper on System.in, the library would need to be modified so that all code uses the same buffered wrapper instead of creating separate ones.

Implementation Details

This program was compiled with the command javac InputLibrary.java on a system with Java 1.5.0. When run from the command line with java InputLibrary, the program will successfully take two characters as input and print them out. Also, when run with java InputLibrary < input, where input is a file that contains the exact same input, the program will successfully take two characters as input and print them out.

import java.io.BufferedInputStream;
import java.io.IOException;

public final class InputLibrary{

  private static BufferedInputStream in = new BufferedInputStream(System.in);

  public static char getChar()throws IOException {
    int input = in.read();
    if(input==-1){
    	throw new IOException();
    }
    in.skip(1); //This line now necessary to go to the next line
                //in the previous example code deceptively worked without it
    return (char)input;
  }

  public static void main(String[] args)throws IOException {
    System.out.print("Enter first initial: ");
    char first=getChar();
    System.out.println("Your first initial is "+first);
    System.out.print("Enter last initial: ");
    char last=getChar();
    System.out.println("Your last initial is "+last);
  }
}

...