Page History

Wiki MarkupNative methods are defined in Java and written in traditional languages such as C and C++ \[ [JNI 06|AA. Java References#JNI 06]\]). The added extensibility comes at the cost of flexibility and portability as the code no longer conforms to the policies enforced by Java. In the past, native method were used for performing platform specific operations, interfacing with legacy library code and improving program performance \[[Bloch 08|AA. Java References#Bloch 08]\]. Although this is not completely true in present times (due to poor portability, safety and quite ironically, performance issues), they are still used to interface with legacy code2006]. The added extensibility comes at the cost of flexibility and portability because the code no longer conforms to the policies enforced by Java. Native methods have been used for performing platform-specific operations, interfacing with legacy library code, and improving program performance [Bloch 2008].

Defining a wrapper method facilitates carrying out installing appropriate security manager checks, perform input validation before passing the arguments to the validating arguments passed to native code, validating return values, defensively copy copying mutable inputs and sanitize user supplied input, and sanitizing untrusted data. Consequently, every native method must be private and must be invoked only by a wrapper method.

Noncompliant Code Example

In this noncompliant code example, the nativeOperation() method is both native and public; consequently, untrusted callers may invoke it. Native method invocations bypass security manager checks.

This example includes the doOperation() wrapper method, which invokes the nativeOperation() Security manager checks are not conducted in case of native method invocations. Additionally, as demonstrated in the noncompliant code example, it is easy to overlook proper input validation before the call. The doOperation method invokes the nativeOperation native method but fails to provide adequate validation. Also, the access specifier of the native method is public which raises risks associated with untrusted callersinput validation or security checks.

public final class NativeMethod {

  // privatePublic native method
  public native void nativeOperation(byte[] data, int offset, int len);

  // wrapperWrapper method that does not perform anylacks security checks orand input validation
  public void doOperation(byte[] data, int offset, int len) {
    nativeOperation(data, offset, len);
  }
  
  static {
    System.loadLibrary("NativeMethodLib"); //load Load native library in static initializer of class
    System.loadLibrary("NativeMethodLib"); 
  }
}

Compliant Solution

This compliant solution makes declares the actual native method private and defines a public wrapper that calls securityManagerCheck() which in turn performs routine permission checks to determine if the succeeding operations can continue. This is followed by input range checking and creation of a . The doOperation() wrapper method checks permissions, creates a defensive copy of the mutable input array , data. Finally the nativeOperation method is called with sanitized inputs. Ensure data, and checks the ranges of the arguments. The nativeOperation() method is consequently called with secure inputs. Note that the validation checks must produce outputs that are coherent with conform to the input requirements of the native implementations/librariesmethods.

public final class NativeMethodWrapper {

  // privatePrivate native method
  private native void nativeOperation(byte[] data, int offset, int len);

  // wrapperWrapper method performs SecurityManager and input validation checks
  public void doOperation(byte[] data, int offset, int len) {
    // permissionPermission needed to invoke native method
    securityManagerCheck();

    if (data == null) {
      throw new NullPointerException();
    }

    // copyCopy mutable input
    data = data.clone();

    // validateValidate input
    if ((offset < 0) || (len < 0) || (offset > (data.length - len))) {
      throw new IllegalArgumentException();
    }

    nativeOperation(data, offset, len);
  }

  static {
    System.loadLibrary("NativeMethodLib"); //load Load native library in static initializer of class
    System.loadLibrary("NativeMethodLib"); 
  }
}

Exceptions

JN100-J-EX0: Native methods that do not require security manager checks, validation of arguments or return values, or defensive copying of mutable inputs (for example, the standard C function int rand(void)) do not need to be wrapped.

Risk Assessment

Failure to define wrappers around native methods can allow unprivileged callers to invoke them and exploit inherent vulnerabilities such as those resulting from invalid input validationbuffer overflows in native libraries.

Automated Detection

...

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

...

Automated detection is not feasible in the fully general case. However, an approach similar to Design Fragments [Fairbanks 2007] could assist both programmers and static analysis tools.

Tool	Version	Checker	Description
Parasoft Jtest	Include Page Parasoft_V Parasoft_V	CERT.JNI00.NATIW	Use wrapper methods to secure native methods

Related Guidelines

Bibliography

...

...

...

...

Image Added Image Added Image Added \[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 111|http://cwe.mitre.org/data/definitions/111.html] "Direct Use of Unsafe JNI"ENV32-J. Do not grant ReflectPermission with target suppressAccessChecks      01. Platform Security (SEC)      SEC07-J. Do not allow the unauthorized construction of classes existing in untrusted packages