Unsafe Mobile Code - Revision history

Imifos: Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2017-11-10T21:51:39Z

Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2015-12-01T11:52:17Z

fixed classification

2009-03-01T13:37:58Z

‎Dangerous Array Declaration

2009-03-01T13:37:46Z

‎Dangerous Array Declaration

2009-02-21T02:03:01Z

2009-02-19T14:21:03Z

2009-02-17T16:42:38Z

‎Inner Class

2009-02-17T16:40:21Z

2009-02-17T16:38:21Z

2009-02-17T16:38:04Z

‎Dangerous Array Declaration

@@ Line 144: / Line 144: @@
 [[Category:Code Quality Vulnerability]]
 [[Category:Authentication Vulnerability]]
-[[Category:OWASP_Java_Project]]
+[[Category:Java]]
 [[Category:Implementation]]
 [[Category:Code Snippet]]
 [[Category:Vulnerability]]

@@ Line 144: / Line 144: @@
 [[Category:Code Quality Vulnerability]]
 [[Category:Authentication Vulnerability]]
-[[Category:Java]]
+[[Category:OWASP_Java_Project]]
 [[Category:Implementation]]
 [[Category:Code Snippet]]
 [[Category:Vulnerability]]

@@ Line 37: / Line 37: @@
 '''Example'''
-The following Java Applet code mistakenly declares an array public, final and static.
+The following Java Applet code mistakenly declares an array public, final, and static.
 <pre>

@@ Line 31: / Line 31: @@
 ===Dangerous Array Declaration===
-The program violates secure coding principles for mobile code by declaring an array public, final and static.
+The program violates secure coding principles for mobile code by declaring an array public, final, and static.
-In most cases an array declared public, final and static is a bug. Because arrays are mutable objects, the final constraint requires that the array object itself be assigned only once, but makes no guarantees about the values of the array elements. Since the array is public, a malicious program can change the values stored in the array. In most situations the array should be made private.
+In most cases an array declared public, final, and static is a bug. Because arrays are mutable objects, the final constraint requires that the array object itself be assigned only once, but makes no guarantees about the values of the array elements. Since the array is public, a malicious program can change the values stored in the array. In most situations the array should be made private.
 '''Example'''

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==

@@ Line 81: / Line 81: @@
 		...
+	}
 </pre>

@@ Line 61: / Line 61: @@
 	public final class urlTool extends Applet {
 		public URL url;
 		...
+	}

← Older revision		Revision as of 16:38, 17 February 2009
Line 49:		Line 49:
	</pre>		</pre>

		+	===Dangerous Public Field===
		+	The program violates secure coding principles for mobile code by declaring a member variable public but not final.
		+
		+	All public member variables in an Applet and in classes used by an Applet should be declared final to prevent an attacker from manipulating or gaining unauthorized access to the internal state of the Applet.
		+
		+	'''Example'''
		+
		+	The following Java Applet code mistakenly declares a member variable public but not final.
		+
		+	<pre>
		+	public final class urlTool extends Applet {
		+	public URL url;
		+	...
		+	}
		+	</pre>

	==Risk Factors==		==Risk Factors==