SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 8 Next »

As suggested by [[Ware]], instances from the class javax.net.ssl.SSLSocket should be created instead of normal Sockets when transferring objects over communication channels. SSLSockets provide a layer of security protocols such as SSL or TLS.

According to [[Java API]] , the principal protections included in SSLSockets that are not provided by the Socket class are:

  • Integrity Protection. SSL protects against modification of messages by an active wiretapper.
  • Authentication. In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.
  • Confidentiality (Privacy Protection). In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data, so that passive wiretappers won't see sensitive data such as financial information or personal information of many kinds.

Noncompliant code example

This example shows the use of regular Sockets for a server application. Using this kind of Sockets does not protect sensitive information while being in transit.

import java.net.ServerSocket;
import java.net.Socket;
import java.io.*; 

public class EchoServer { 
  public static void main(String[] args) { 
    try { 
      ServerSocket serverSocket = new ServerSocket(10007); 
      Socket socket = serverSocket.accept();
			
      PrintWriter out = new PrintWriter( socket.getOutputStream(),true); 
      BufferedReader in = new BufferedReader(new InputStreamReader( socket.getInputStream())); 

      String inputLine; 

      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
        out.println(inputLine); 
      } 

      out.close(); 
      in.close(); 
      socket.close();  
    }
    catch (Exception e) { 
      /*Handle exception*/
    }   
  }
}

Compliant solution

This is a better solution to the previous example, making use of SSLSockets. By doing so, packets are protected with SSL and TLS security protocols.

import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import java.io.*;

public class EchoServer {
  public static void main(String[] args) {
    try {
      SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
      SSLServerSocket sslserversocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
      SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

      PrintWriter out = new PrintWriter( sslsocket.getOutputStream(),true);
      BufferedReader in = new BufferedReader(new InputStreamReader( sslsocket.getInputStream()));
            
      String inputLine; 
            
      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
	out.println(inputLine); 
      } 
			
      out.close(); 
      in.close(); 
      sslsocket.close(); 
    } 
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}

Noncompliant code example

This is a similar insecure code for the client application. 

import java.io.*;
import java.net.*;

public class EchoClient {
  public static void main(String[] args) {
    try {
      Socket socket = new Socket("localhost", 9999);
						
      PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));

      BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
			
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	System.out.println(in.readLine());
      }

      out.close();
      in.close();
      stdIn.close();
      socket.close();
    }
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}

Compliant solution

This is the client application making use of SSLSockets.

import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.*;

public class EchoClient {
  public static void main(String[] args) {
    try {
      SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
      SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("localhost", 9999);

      PrintWriter out = new PrintWriter(sslsocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader(sslsocket.getInputStream()));
			
      BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
            
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	System.out.println(in.readLine());
      }

      out.close();
      in.close();
      stdIn.close();
      sslsocket.close();		
    } 
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}

Risk assesment

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

SEC36-J

medium

unlikely

low

P6

L2

Exceptions

SEC36-EX1: Due to all the mechanisms that SSLSockets provide to ensure the secure transfer of packets, a significant decay in performance could be perceived. If no sensitive information is being transmitted, or the channel used is not prone to attacks, the implementation of regular Sockets should be sufficient.

SEC36-EX2: Notice that a program that makes use of SSLSockets will hang if it tries to connect to a port that is not using SSL and, similarly, a program that does not use SSLSockets will hang when trying to establish connection with a port using SSL.

References

[[API 06]]
[[Ware 08]]

  • No labels