...
| Code Block | ||
|---|---|---|
| ||
protected PermissionCollection getPermissions(CodeSource cs) {
PermissionCollection pc = new Permissions();
// allowAllow exit from the VM anytime
pc.add(new RuntimePermission("exitVM"));
return pc;
}
|
...
In this compliant solution, the getPermissions() method calls super.getPermissions(). As a result, the default systemwide security policy is applied , in addition to the custom policy.
| Code Block | ||
|---|---|---|
| ||
protected PermissionCollection getPermissions(CodeSource cs) {
PermissionCollection pc = super.getPermissions(cs);
// allowAllow exit from the VM anytime
pc.add(new RuntimePermission("exitVM"));
return pc;
}
|
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
SEC07-J | High | Probable | Low | P18 | L1 |
Automated Detection
Violations of this rule can be discovered with a heuristic checker in the style of FindBugs. As with all heuristic checks, achieving a low false-positive rate is essential.
Android Implementation Details
The java.security package exists on Android for compatibility purposes only, and it should not be used.
Bibliography
| |
|
...
14. Platform Security (SEC) SEC08-J. Define wrappers around native methods