Unsafe Mobile Code: Inner Class - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to www.textchizelolob.com

2009-05-27T18:29:36Z

Reverting to last version not containing links to www.textchizelolob.com

Deleted user at 16:49, 22 May 2009

2009-05-22T16:49:16Z

KirstenS at 23:32, 7 April 2009

2009-04-07T23:32:19Z

KirstenS at 16:40, 17 February 2009

2009-02-17T16:40:09Z

KirstenS at 14:23, 9 November 2008

2008-11-09T14:23:42Z

KirstenS at 13:18, 13 October 2008

2008-10-13T13:18:48Z

KirstenS at 13:50, 3 October 2008

2008-10-03T13:50:03Z

Weilin Zhong: Moved the definition of mobile code and its security concern to :Category:Unsafe Mobile Code.

2006-07-21T17:21:36Z

Moved the definition of mobile code and its security concern to :Category:Unsafe Mobile Code.

Weilin Zhong: Contents provided by Fortify.

2006-07-21T17:04:35Z

Contents provided by Fortify.

New page

{{Template:Vulnerability}}
{{Template:Fortify}}

==Abstract==

The program violates secure coding principles for mobile code by making use of an inner class.

==Description==

Inner classes quietly introduce several security concerns because of the way they are translated into Java bytecode. In Java source code, it appears that an inner class can be declared to be accessible only by the enclosing class, but Java bytecode has no concept of an inner class, so the compiler must transform an inner class declaration into a peer class with package level access to the original outer class. More insidiously, since an inner class can access private fields in their enclosing class, once an inner class becomes a peer class in bytecode, the compiler converts private fields accessed by the inner class into protected fields.

==Examples ==

The following Java Applet code mistakenly makes use of an inner class.

<pre>
public final class urlTool extends Applet {
private final class urlHelper {
...
}
...
}
</pre>

Mobile code, in this case a Java Applet, is code that is transmitted across a network and executed on a remote machine. Because mobile code developers have little if any control of the environment in which their code will execute, special security concerns become relevant. One of the biggest environmental threats results from the risk that the mobile code will run side-by-side with other, potentially malicious, mobile code. Because all of the popular web browsers execute code from multiple sources together in the same JVM, many of the security guidelines for mobile code are focused on preventing manipulation of your objects' state and behavior by adversaries who have access to the same virtual machine where your program is running.

==Related Principles==

[[Use encapsulation]]

==Related Threats==

==Related Attacks==

==Related Vulnerabilities==

==Related Countermeasures==

==Categories==

[[Category:Code Quality Vulnerability]]

[[Category:Access Control Vulnerability]]

[[Category:Java]]

[[Category:Implementation]]

[[Category:Code Snippet]]

← Older revision		Revision as of 18:29, 27 May 2009
Line 1:		Line 1:
−	~~http://www.textchizelolob.com~~
	{{template:CandidateForDeletion}}		{{template:CandidateForDeletion}}

← Older revision		Revision as of 16:49, 22 May 2009
Line 1:		Line 1:
		+	http://www.textchizelolob.com
	{{template:CandidateForDeletion}}		{{template:CandidateForDeletion}}

← Older revision		Revision as of 23:32, 7 April 2009
Line 3:		Line 3:
	#REDIRECT [[Unsafe Mobile Code]]		#REDIRECT [[Unsafe Mobile Code]]

−	~~__TOC__~~
−
−	~~[[ASDR Table of Contents]]~~

@@ Line 1: / Line 1: @@
-{{Template:Vulnerability}}
+{{template:CandidateForDeletion}}
-{{Template:Fortify}}
 __TOC__
@@ Line 6: / Line 7: @@
 [[ASDR Table of Contents]]
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
@@ Line 68: / Line 67: @@
 __NOTOC__

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template, needs review]]
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
@@ Line 65: / Line 65: @@
 TBD
 __NOTOC__
@@ Line 96: / Line 72: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Code Quality Vulnerability]]
-[[Category:Access Control Vulnerability]]
+[[Category:Session Management Vulnerability]]
 [[Category:Unsafe Mobile Code]]
 [[Category:Java]]
 [[Category:Implementation]]
 [[Category:Code Snippet]]

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 ==Description==
 Inner classes quietly introduce several security concerns because of the way they are translated into Java bytecode. In Java source code, it appears that an inner class can be declared to be accessible only by the enclosing class, but Java bytecode has no concept of an inner class, so the compiler must transform an inner class declaration into a peer class with package level access to the original outer class. More insidiously, since an inner class can access private fields in their enclosing class, once an inner class becomes a peer class in bytecode, the compiler converts private fields accessed by the inner class into protected fields.
@@ Line 12: / Line 20: @@
 For more details about mobile code and its security concerns, please see [[:Category:Unsafe Mobile Code]].
 ==Examples ==
 The following Java Applet code mistakenly makes use of an inner class.
@@ Line 25: / Line 38: @@
 </pre>
-==Related Principles==
+==Related [[Attacks]]==
-[[Use encapsulation]]
+Configuration Vulnerability
-==Related Threats==
+Cryptographic Vulnerability
-==Related Attacks==
+Encoding Vulnerability
-==Related Vulnerabilities==
+Error Handling Vulnerability
-==Related Countermeasures==
+Input Validation Vulnerability
-==Categories==
+Logging and Auditing Vulnerability
 [[Category:Code Quality Vulnerability]]
 [[Category:Access Control Vulnerability]]
 [[Category:Unsafe Mobile Code]]
 [[Category:Java]]
 [[Category:Implementation]]
 [[Category:Code Snippet]]