SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 9 Next »

The APIs tabulated below perform tasks using the immediate caller's class loader.

APIs

java.lang.Class.forName

java.lang.Package.getPackage(s)

java.lang.Runtime.load

java.lang.Runtime.loadLibrary

java.lang.System.load

java.lang.System.loadLibrary

java.sql.DriverManager.getConnection

java.sql.DriverManager.getDriver(s)

java.sql.DriverManager.deregisterDriver

java.util.ResourceBundle.getBundle

Noncompliant Code Example

The untrustedCode method invokes loadLibrary method in this noncompliant example. This is dangerous as the library gets loaded on behalf of the untrusted code. The acceptance of tainted inputs from the untrusted code further exacerbates this issue. In essence, untrusted code's class loader may be able to load the intended library even if it does not have sufficient permissions.

public static void untrustedCode() {
  loadLibrary("/com/foo/MyLib.so");
}  

public static void loadLibrary() {
  System.loadLibrary(lib);
}

Compliant Solution

Ensure that untrusted code cannot invoke the affected APIs directly or indirectly (that is, via a call to an invoking method). Do not operate on tainted inputs and make sure that internal objects are not returned to untrusted code. 

public static void loadLibrary() {
  System.loadLibrary("/com/foo/HardcodedLib.so");
}

Risk Assessment

Allowing untrusted code to load libraries using the immediate caller's class loader may seriously compromise the security of a java application.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

SEC03-J

medium

probable

high

P4

L3

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[SCG 07]] Guideline 6-3 Safely invoke standard APIs that perform tasks using the immediate caller's class loader instance

SEC02-J. Beware of standard APIs that may bypass Security Manager checks      00. Security (SEC)      SEC04-J. Beware of standard APIs that perform access checks against the immediate caller

  • No labels