SEC04-A. Beware of standard APIs that perform access checks against the immediate caller

It is possible to access fields and methods of another object from a given object. Language access checks are enforced by the JVM to ensure policy compliance, while doing so. For instance, although an object is not normally allowed to access private members or invoke methods of another class, the APIs belonging to java.lang.reflect package allow an object to do so contingent upon performing the mirrored language access checks.

Non-Compliant Code Example

In this non-compliant code snippet, the private field of class C (i) can be accessed from class reflection. Method makeAccessible accepts fieldName as input which can be supplied by untrusted code. This is dangerous because despite the untrusted code not having the same capabilities as that of the immediate caller, it is allowed to carry out sensitive operations.

import java.lang.reflect.Field;
public class reflection {

  public static void makeAccessible(String fieldName) {
    C c = new C();
    try {
	Field f = c.getClass().getDeclaredField(fieldName);
	System.out.println(f.isAccessible());
	f.setAccessible(true);
	System.out.println(f.isAccessible());
	System.out.println(f.getInt(c));
    }
    catch(NoSuchFieldException nsfa){}
    catch(IllegalAccessException iae) {}
  }
}

class C {
  private int i = 10;
}

Compliant Solution

Avoid invoking affected APIs on Class, Constructor, Field or Method instances passed in from untrusted code. Even when the instances are acquired safely, do not use tainted inputs provided by untrusted code. Likewise, do not return values to the untrusted caller. The table below lists the APIs that should be used with care.

References

The Java Class Libraries: Supplement for the Java 2 Platform, Standard Edition (java.lang.reflect Accessible Object)
Sun Java Secure Coding Guidelines