...
Code Block | ||
---|---|---|
| ||
public final class NativeMethodWrapper { // Private native method private native void nativeOperation(byte[] data, int offset, int len); // Wrapper method performs SecurityManager and input validation checks public void doOperation(byte[] data, int offset, int len) { // Permission needed to invoke native method securityManagerCheck(); if (data == null) { throw new NullPointerException(); } // Copy mutable input data = data.clone(); // Validate input if ((offset < 0) || (len < 0) || (offset > (data.length - len))) { throw new IllegalArgumentException(); } nativeOperation(data, offset, len); } static { // Load native library in static initializer of class System.loadLibrary("NativeMethodLib"); } } |
Exceptions
JN100-J-EX0: Native methods that do not require security manager checks, validation of arguments or return values, or defensive copying of mutable inputs (for example, the standard C function int rand(void)
) do not need to be wrapped.
...
Failure to define wrappers around native methods can allow unprivileged callers to invoke them and exploit inherent vulnerabilities such as buffer overflows in native libraries.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
JNI00-J | Medium | Probable | High | P4 | L3 |
Automated Detection
Automated detection is not feasible in the fully general case. However, an approach similar to Design Fragments [Fairbanks 2007] could assist both programmers and static analysis tools.
Tool | Version | Checker | Description |
---|---|---|---|
Parasoft Jtest |
| CERT.JNI00.NATIW |
Use wrapper methods to secure native methods |
Related Guidelines
CWE-111, Direct Use of Unsafe JNI | |
Guideline 5-3 / INPUT-3: Define wrappers around native methods |
Bibliography
...
...