Page History

Wiki MarkupNative methods are defined in Java and written in traditional languages such as C and C++ \[ [JNI 2006|AA. Bibliography#JNI 06]\]. The added extensibility comes at the cost of flexibility and portability as because the code no longer conforms to the policies enforced by Java. In the past, native methods were used for performing platform specific operations, interfacing with legacy library code and improving program performance \[[Bloch 2008|AA. Bibliography#Bloch 08]\]. Although this is no longer completely true---because of poor portability, safety and (quite ironically) performance issues---native code is still used to interface with legacy codeNative methods have been used for performing platform-specific operations, interfacing with legacy library code, and improving program performance [Bloch 2008].

Defining a wrapper method facilitates installing appropriate security manager checks, performing input validation before passing the arguments to the native code or when obtaining validating arguments passed to native code, validating return values, defensively copying mutable inputs, and sanitizing user input untrusted data. Consequently, every native method must be private and must be invoked only by a wrapper method.

Noncompliant Code Example

In this noncompliant code example, the nativeOperation() method is both native and public; consequently, untrusted callers may invoke it. Native method invocations bypass security manager checks.

This example includes the Additionally, as demonstrated in this noncompliant code example, it is easy to overlook proper input validation before the native method invocation. The doOperation() wrapper method, which invokes the nativeOperation() native method but fails to provide adequate input validation . Further, untrusted callers can invoke the native method because its access specifier is publicor security checks.

public final class NativeMethod {

  // publicPublic native method
  public native void nativeOperation(byte[] data, int offset, int len);

  // wrapperWrapper method that lacks security checks and input validation
  public void doOperation(byte[] data, int offset, int len) {
    nativeOperation(data, offset, len);
  }
  
  static {
    // loadLoad native library in static initializer of class
    System.loadLibrary("NativeMethodLib"); 
  }
}

Compliant Solution

This compliant solution declares the native method private and defines a public wrapper that calls the securityManagerCheck. The doOperation() method. The wrapper method performs routine permission checking to determine whether the succeeding operations are permitted to continue. This is followed by the creation of wrapper method checks permissions, creates a defensive copy of the mutable input array data as well as by range checking , and checks the ranges of the parametersarguments. The nativeOperation() method is thus consequently called with safe secure inputs. Note that the validation checks must produce outputs that conform to the input requirements of the native implementations/librariesmethods.

public final class NativeMethodWrapper {

  // privatePrivate native method
  private native void nativeOperation(byte[] data, int offset, int len);

  // wrapperWrapper method performs SecurityManager and input validation checks
  public void doOperation(byte[] data, int offset, int len) {
    // permissionPermission needed to invoke native method
    securityManagerCheck();

    if (data == null) {
      throw new NullPointerException();
    }

    // copyCopy mutable input
    data = data.clone();

    // validateValidate input
    if ((offset < 0) || (len < 0) || (offset > (data.length - len))) {
      throw new IllegalArgumentException();
    }

    nativeOperation(data, offset, len);
  }

  static {
    // loadLoad native library in static initializer of class
    System.loadLibrary("NativeMethodLib"); 
  }
}

Exceptions

JN100-J-EX0: Native methods that do not require security manager checks, validation of arguments or return values, or defensive copying of mutable inputs (for example, the standard C function int rand(void)) do not need to be wrapped.

Risk Assessment

Failure to define wrappers around native methods can allow unprivileged callers to invoke them and thus exploit inherent vulnerabilities such as those resulting from invalid inputsbuffer overflows in native libraries.

Automated Detection

...

Automated detection is not feasible in the fully general case. However, an approach similar to Design Fragments \[ [Fairbanks 07|AA. Bibliography#Fairbanks 07]\] could assist both programmers and static analysis tools.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

...

2007] could assist both programmers and static analysis tools.

Related Guidelines

Bibliography

...

...

...

...

...

Image Added Image Added Image Added \[[SCG 2007|AA. Bibliography#SCG 07]\] Guideline 3-3 Define wrappers around native methodsSEC17-J. Create and sign a SignedObject before creating a SealedObject      02. Platform Security (SEC)      SEC19-J. Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar