Page History

Java classes and methods may have invariants. An invariant is a property that is assumed to be true at certain points during program execution but is not formally specified as true. Invariants may be used in assert statements or may be informally specified in comments.

Method invariants can include guarantees made about what the method can do, requirements about the state of the object when the method is invoked, or guarantees about the state of the object when the method completes. For example, a method of a Date class might guarantee that 1 <= day_of_month <= 31 when the method exits.  

Class invariants are guarantees made about the state of their objects' fields upon the completion of any of their methods. For example, classes whose member fields may not be modified once they have assumed a value are called immutable classes. An important consequence of immutability is that the invariants of instances of these classes are preserved throughout their lifetimes.

Similarly, classes can rely on invariants to properly implement their public interfaces. These invariants might relate to the state of member fields or the implementation of member methods. Generally, classes can rely on encapsulation to help maintain these invariants, for example, by making member fields private. However, encapsulation can be incompatible with extensibility. For example, a class designer might want a method to be publicly accessible yet rely on the particulars of its implementation when using it in another method within the class. In this case, overriding the method in a subclass can break the internal invariants of the class.  Extensibility consequently carries with it two significant risks: a subclass can fail to satisfy the invariants promised to clients by its superclass, and it can break the internal invariants on which the superclass relies. For example, an immutable class that lacks the final qualifier can be extended by a malicious subclass that can modify the state of the supposedly immutable object. Furthermore, a malicious subclass object can impersonate the immutable object while actually remaining mutable. Such malicious subclasses can violate program invariants on which clients depend, consequently introducing security vulnerabilities. Note that the same can be said for a benign subclass that mistakenly supports mutability. These risks relate to both benign and malicious development.

To mitigate these risks, by default classes should be declared final unless there is a definite need for the class to be extensible. In that case, developers must carefully design the class with extensibility in mind. As a specific instance of this recommendation, classes that are designed to be treated as immutable either must be declared final or must have all of their member methods and fields declared final or private.

In systems where code can come from mixed protection domains, some superclasses might want to Some classes ("parent classes" hereafter) must permit extension by trusted subclasses while simultaneously preventing extension by untrusted code. Declaring such parent classes superclasses to be final is not an option, infeasible because it would prevent the required extension by trusted code. Such problems require careful design for inheritance.

Consider two classes belonging to different protection domains; one is malicious, and estends the other, which is a trusted parent class.  Consider an object of the malicious class with a fully qualified invocation of a method defined by the trusted parent, and not overridden by the malicious class. In this case, the trusted parent class's permissions are examined to execute the method, with the consequence that the malicious object gets the method invoked inside the protection domain of the trusted parent class.  \[[Gong 2003|AA. Bibliography#Gong 03]\].

One commonly suggested solution is to place code at each point where the parent class can be instantiated to ensure that the instance being created has the same type as the parent class. When the type is found to be that of a subclass instead of the parent class's type, the checking code performs a security manager check to ensure that malicious classes cannot misuse the parent class. This approach is insecure because it allows a malicious class to add a finalizer and obtain a partially initialized instance of the parent class. This attack is detailed in guideline OBJ04-J. Do not allow access to partially initialized objects.

For non-final classes, the method that performs the security manager check must be invoked as an argument to a private constructor to ensure that the security check is performed before any superclass's constructor can exit.

When the parent class has members that are declared private or are otherwise inaccessible to the attacker, the attacker must use reflection to exploit those members of the parent class. Declaring the parent class or its methods final prohibits this level of access.

Noncompliant Code Example

In this noncompliant code example, a malicious class can extend the public non-final parent class, NonFinal. Consequently, the attacker can invoke any of the parent class's accessible instance methods, can access the parent class's protected fields, and can even override any of the parent class's accessible non-final methods.

public class NonFinal {
  public NonFinal() {
    // ...   
  }
}

Noncompliant Code Example (Security Manager)

This noncompliant code example installs a security manager check in the constructor of the non-final parent class. The security manager denies access when it detects that a subclass without the requisite permissions is attempting to instantiate the superclass \[[SCG 2007|AA. Bibliography#SCG 07]\]. It also compares class types, in compliance with [OBJ06-J. Compare classes and not class names].

. One commonly suggested approach is to place code at each point where the superclass can be instantiated to check that the class being instantiated is either the superclass itself or a trustworthy subclass. However, this approach is brittle and is safe only in Java SE 6 or higher (see OBJ11-J. Be wary of letting constructors throw exceptions for a full discussion of the issues involved).

Noncompliant Code Example (BigInteger)

The java.math.BigInteger class is itself an example of noncompliant code. It is nonfinal and consequently extendable, which can be a problem when operating on an instance of BigInteger that was obtained from an untrusted client. For example, a malicious client could construct a spurious mutable BigInteger instance by overriding BigInteger's member functions [Bloch 2008].

The following code example demonstrates such an attack:

// Malicious subclassing of java.math.BigInteger
class BigInteger extends java.math.BigInteger {
  private byte[] ba;

  public BigInteger(String str) {
    super(str);
    ba = (new java.math.BigInteger(str)).toByteArray();
  }

  public BigInteger(byte[] ba) {
    super(ba);
    this.ba = ba;
  }

  public void setValue(byte[] ba) {
    this.ba = ba;
  }

  @Override public byte[] toByteArray() {
    return ba;
  }
}

Unlike the benign BigInteger class, this malicious BigInteger class is clearly mutable because of the setValue() method. Any code that receives an object of this class and assumes that the object is immutable will behave unexpectedly, as shown by the following code:

BigInteger bi = new BigInteger("123");

bi.setValue((new BigInteger("246")).toByteArray());

System.out.println(new BigInteger(bi.toByteArray()));  

This code prints: "246", which shows that the value of the supposedly immutable BigInteger bi has been changed.

OBJ01-J. Limit accessibility of fields points out that invariants cannot be enforced for mutable objects. TSM03-J. Do not publish partially initialized objects describes object construction and visibility issues specific to mutable objects, and CON50-J. Do not assume that declaring a reference volatile guarantees safe publication of the members of the referenced object and CON52-J. Document thread-safety and use annotations where applicable discuss some concurrency issues associated with mutable objects.

Violation of this recommendation can be mitigated by treating objects from untrusted sources as potentially malicious subclasses, as directed by OBJ06-J. Defensively copy mutable inputs and mutable internal components. Complying with that rule protects you from the consequences of violating this recommendation.

This example is particularly important because the BigInteger type has several useful cryptographic applications.

Noncompliant Code Example (Security Manager)

This noncompliant code example proposes adding a security manager check in the constructor of the java.math.BigInteger class. The security manager denies access when it detects that a subclass without the requisite permissions is attempting to instantiate the superclass [SCG 2009]. It also compares class types, in compliance with OBJ09-J. Compare classes and not class names. Note that this check does not prevent malicious extensions of BigInteger; it instead prevents the creation of BigInteger objects from untrusted code, which also prevents creation of objects of malicious extensions of BigInteger.

package java.math;
 
// ...
 
public class BigInteger {
  public BigInteger(String str) {
    securityManagerCheck(); 

    // ...
  }

  

public class NonFinal {
  public NonFinal() {
    Class c = getClass();  // java.lang.Object.getClass(), which is final
    // Confirm class type
    if (c != NonFinal.class) {
      // Check the permission needed to subclass NonFinalBigInteger
      securityManagerCheck(); // throws a security exception if not allowed
  private void securityManagerCheck() }{
    // ...   
  }
}

Unfortunately, throwing an exception from the constructor of a non-final nonfinal class is insecure because it allows a finalizer attack (see guideline OBJ04see OBJ11-J. Be wary of letting constructors throw exceptions). Furthermore, since BigInteger is Serializable, an attacker could bypass the security check by deserializing a malicious instance of BigInteger. For more information on proper deserialization, see the rule SER04-J. Do not allow access to partially initialized objects).serialization and deserialization to bypass the security manager.

Compliant Solution (Final)

This compliant solution prevents creation of malicious subclasses by declaring the immutable java.math.BigInteger class to be final. Although this solution would be appropriate for locally maintained code, it cannot be used in the case of java.math.BigInteger because it would require changing the Java SE API, which has already been published and must remain compatible with previous versions.

package java.math;

// ...

final class BigInteger {
  // ...
}

Compliant Solution (Java SE 6

...

,

...

Public and

...

Private Constructors)

This compliant solution invokes a security manager check as a side - effect of computing the boolean Boolean value passed to a private constructor (as seen in guideline OBJ04OBJ11-J. Do not allow access to partially initialized objectsBe wary of letting constructors throw exceptions). The rules for order of evaluation require that the security manager check must execute before invocation of the private constructor. Consequently, the security manager check also executes before invocation of any superclass's constructor. Note that the security manager check is made without regard to whether the object under construction has the type of the parent class or the type of a subclass (whether trusted or not).

This solution thwarts prevents the finalizer attack. It is specific ; it applies to Java SE 6 and onwardslater versions, where a finalizer is prevented from being executed when throwing an exception is thrown before the java.lang.Object constructor exits prevents execution of finalizers [SCG 2009].

package java.math;

// ...

public class NonFinalBigInteger {
  public NonFinalBigInteger(String str) {
    this(str, check( this.getClass())); // throws a security exception if not allowed
  }
  
  private NonFinalBigInteger(String str, boolean securityManagerCheckdummy) {
    // regularRegular construction goes here
  }

  private static boolean check(Class c) {
    // Confirm class type
    if (c != NonFinal.class) {
      // Check the permission needed to subclass NonFinal
      securityManagerCheck(); // throws a security exception if not allowed
    }

    return true;
  }
}

Risk Assessment

Permitting a non-final class or method to be inherited without checking the class instance allows a malicious subclass to misuse the privileges of the class.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

\[[Bloch 2008|AA. Bibliography#Bloch 08]\] Item 1: "Consider static factory methods instead of constructors"
\[[Gong 2003|AA. Bibliography#Gong 03]\] Chapter 6: "Enforcing Security Policy"
\[[Lai 2008|AA. Bibliography#Lai 08]\]
\[[McGraw 2000|AA. Bibliography#McGraw 00]\] Chapter Seven Rule 3: "Make Everything Final, Unless There's a Good Reason Not To"\[[SCG 2007|AA. Bibliography#SCG 07]\] Guideline 1-2 "Limit the extensibility of classes and methods"

Automated Detection

This recommendation is not checkable because it depends on factors that are unspecified in the code, including the invariants upon which the code relies and the necessity of designating a class as extensible, among others. However, simple statistical methods might be useful to find codebases that violate this recommendation by checking whether a given codebase contains a higher-than-average number of classes left nonfinal.

Related Guidelines

Bibliography

...

Image Added Image Added Image AddedOBJ04-J. Do not allow access to partially initialized objects      04. Object Orientation (OBJ)      OBJ06-J. Compare classes and not class names