Noncompliant Code Example
...
This noncompliant code example shows a changePassword() method that attempts to open a password file using a doPrivileged block. The doPrivileged block also contains logic that operates on the file and a superfluous System.loadLibrary() call.
| Code Block | ||
|---|---|---|
| ||
public void changePassword() {
final FileInputStream f[] = { null };
AccessController.doPrivileged(new PrivilegedAction() {
public Object run() {
try {
String passwordFile = System.getProperty("user.dir") + File.separator
+ "PasswordFileName";
f[0] = new FileInputStream(passwordFile);
// Operations on the file ...
System.loadLibrary("LibName");
} catch (FileNotFoundException cnf) {
// Forward to handler
}
return null;
}
}); // end of doPrivileged()
}
|
This is a violation of the principle of least privilege because a caller who does not have the required privileges can indirectly load the library provided the security policy allows doing so. This transfers the burden of ensuring security to the administrator who implements the security policy.
...
| Wiki Markup |
|---|
This compliant solution removes the call to {{System.loadLibrary()}}. Any operations on the file descriptor {{f\[0\]}} must also occur outside the privileged block to make it easier to audit privileged code. However, {{f\[0\]}} should not leak out to untrusted code (see [SEC02-J. Guard doPrivileged blocks against untrusted invocations]). Minimize the amount of code that requires elevated privileges; this eases the necessary task of auditing privileged code. |
| Code Block | ||
|---|---|---|
| ||
public void changePassword() {
final FileInputStream f[] = { null };
AccessController.doPrivileged(new PrivilegedAction() {
public Object run() {
try {
String passwordFile = System.getProperty("user.dir") + File.separator
+ "PasswordFileName";
f[0] = new FileInputStream(passwordFile);
} catch (FileNotFoundException cnf) {
// Forward to handler
}
return null;
}
}); // end of doPrivileged()
// Operations on the file ...
}
|
...
using handle f[0]
// Ensure that the file reference remains contained within changePassword()
}
|
Risk Assessment
Failure to follow the principle of least privilege can lead to privilege escalation.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
SEC00 SEC21-J | high | probable | high | P6 | L2 |
Automated Detection
...
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Bibliography
| Wiki Markup |
|---|
\[[API 2006|AA. Bibliography#API 06]\] Class {{java.security.AccessController}}
\[[McGraw 2000|AA. Bibliography#McGraw 00]\]
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] CWE [272|http://cwe.mitre.org/data/definitions/272.html] |
...
02. Platform Security (SEC)SEC20-J. Do not expect java.lang.reflect.method.invoke() to behave as the immediate caller 02. Platform Security (SEC) SEC01-J. Minimize the accessibility of classes and their members03. Declarations and Initialization (DCL)