Native methods are defined in Java and written in languages such as C and C++ [JNI 2006]. The added extensibility comes at the cost of flexibility and portability because the code no longer conforms to the policies enforced by Java. Native methods have been used for performing platform-specific operations, interfacing with legacy library code, and improving program performance [Bloch 2008].
Defining a wrapper method facilitates installing appropriate security manager checks, validating arguments passed to native code, validating return values, defensively copying mutable inputs, and sanitizing untrusted data. Consequently, every native method must be private and must be invoked only by a wrapper method.
Noncompliant Code Example
In this noncompliant code example, the
nativeOperation() method is both native and public; consequently, untrusted callers may invoke it. Native method invocations bypass security manager checks.
This example includes the
doOperation() wrapper method, which invokes the
nativeOperation() native method but fails to provide input validation or security checks.
This compliant solution declares the native method private. The
doOperation() wrapper method checks permissions, creates a defensive copy of the mutable input array
data, and checks the ranges of the arguments. The
nativeOperation() method is consequently called with secure inputs. Note that the validation checks must produce outputs that conform to the input requirements of the native methods.
JN100-J-EX0: Native methods that do not require security manager checks, validation of arguments or return values, or defensive copying of mutable inputs (for example, the standard C function
int rand(void)) do not need to be wrapped.
Automated detection is not feasible in the fully general case. However, an approach similar to Design Fragments [Fairbanks 2007] could assist both programmers and static analysis tools.
|CERT.JNI00.NATIW||Use wrapper methods to secure native methods|
CWE-111, Direct Use of Unsafe JNI
Guideline 5-3 / INPUT-3: Define wrappers around native methods