...
This rule concerns untrusted information entering a doPrivileged() block. For prevention of sensitive information escaping from a doPrivileged() block, see SEC02SEC00-J. Do not allow doPrivileged() blocks to leak sensitive information outside a trust boundary.
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f5b12566850dd142-23ddc572-426748b3-ba949cfc-93d0aa311f4c80d34eb6dbf7"><ac:plain-text-body><![CDATA[ | [[API 2006 | AA. Bibliography#API 06]] | [method doPrivileged() | http://java.sun.com/javase/6/docs/api/java/security/AccessController.html#doPrivileged(java.security.PrivilegedAction)] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b028b5dfc406ccf3-76d3c1ae-4b6e4501-b51696fd-504da40f94fd9073af385d2f"><ac:plain-text-body><![CDATA[ | [[Gong 2003 | AA. Bibliography#Gong 03]] | Sections 6.4, "AccessController" | ]]></ac:plain-text-body></ac:structured-macro> | |
| 9.5 "Privileged Code" | ||||
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c619a75d11c8cc53-397f4d2d-485b44fe-be5c8f4b-9c7f8cf52b624c44bb7ff736"><ac:plain-text-body><![CDATA[ | [[Jovanovic 2006 | AA. Bibliography#Jovanovic 06]] | "Pixy: A Static Analysis Tool for Detecting Web Application Vulnerabilities" | ]]></ac:plain-text-body></ac:structured-macro> |
...
SEC02SEC00-J. Do not allow doPrivileged() blocks to leak sensitive information outside a trust boundary 14. Platform Security (SEC) SEC04-J. Do not load trusted classes after allowing untrusted code to load arbitrary classes