Page History

Sensitive data must be protected from eavesdropping and . All data that crosses a trust boundary must be protected from malicious tampering. An obfuscated transfer object [Steel 2005] that is strongly encrypted can protect data. This approach is known as sealing the object. To guarantee object integrity, apply a digital signature to the sealed object.

Sealing and signing objects is the preferred mechanism to secure data when

• Serializing or transporting sensitive Transporting sensitive data or serializing any data.
• A secure communication channel such as Secure Sockets Layer (SSL) is absent or is too costly for limited transactions.
• Sensitive data must persist over an extended period of time (for example, on a hard drive).

Avoid using home-brewed cryptographic algorithms; such algorithms will almost certainly introduce unnecessary vulnerabilities. Applications that apply home-brewed "cryptography" in the readObject() and writeObject() methods are prime examples of anti-patterns. However, using existing cryptography libraries inside readObject() and writeObject() is perfrectly warranted.

This rule applies to the intentional serialization of sensitive information. SER03-J. Do not serialize unencrypted sensitive data is meant to prevent the unintentional serialization of sensitive information.

...

This noncompliant code example simply serializes then deserializes the map. Consequently, the map can be serialized and transferred across different business tiers. Unfortunately, the example lacks any safeguards against byte stream manipulation attacks while the binary data is in transit. Likewise, anyone can reverse-engineer the serialized stream data to recover the data in the HashMap. Anyone would also be able to tamper with the map and produce an object that made the deserializer crash or hang.

public static void main(String[] args)
                        throws IOException, ClassNotFoundException {
  // Build map
  SerializableMap<String, Integer> map = buildMap();

  // Serialize map
  ObjectOutputStream out =
      new ObjectOutputStream(new FileOutputStream("data"));
  out.writeObject(map);
  out.close();

  // Deserialize map
  ObjectInputStream in =
      new ObjectInputStream(new FileInputStream("data"));
  map = (SerializableMap<String, Integer>) in.readObject();
  in.close();

  // Inspect map
  InspectMap(map);
}

...

Failure to sign and then seal objects during transit can lead to loss of object integrity or confidentiality.

Automated Detection

This rule is not amenable to static analysis in the general case.

Related Guidelines

Bibliography

...

...