Page History

...

Code Block

bgColor	#FFCCCC

BigInteger msg = new BigInteger("123");
msg = msg.modPow(exp, m);  // Always returns 1

// Malicious subclassing of java.math.BigInteger
class BigInteger extends java.math.BigInteger {
  private int value;

  public BigInteger(String str) {
    super(str);
    value = Integer.parseInt( str);
  }

  public setValue(int value) {
    this.value = value;
  }

  @Override public java.math.BigInteger modPow(java.math.BigInteger exponent, java.math.BigInteger m) {
    this.value = ((int) (Math.pow( this.value, exponent))) % m;
    return this;
  }
}

...

Code Block

bgColor	#ccccff

public class BigInteger {
  public BigInteger(String str) {
    this( str, check( this.getClass())); // throws a security exception if not allowed
  }

  private BigInteger(String str, boolean securityManagerCheck) {
    // regular construction goes here
  }

  private static boolean check(Class c) {
    // Confirm class type
    if (c != BigInteger.class) {
      // Check the permission needed to subclass BigInteger
      securityManagerCheck(); // throws a security exception if not allowed
    }

    return true;
  }
}

Noncompliant Code Example (Data-Driven Execution)

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="bd781e595063c116-f0a957e9-45874f7e-a9c593aa-1df8683ea6ffc7b3d0e626fc"><ac:plain-text-body><![CDATA[	[[API 2006	AA. Bibliography#API 06]]	Class BigInteger	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5034a867b2868dd3-04a1d156-4cad40c6-afeda066-1045f698fde0f40484fab546"><ac:plain-text-body><![CDATA[	[[Bloch 2008	AA. Bibliography#Bloch 08]]	Item 1: "Consider static factory methods instead of constructors"	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="91e153499f7d6a0b-5b9d35f8-402a4849-ba1a8e81-93d420f3f27d4dc4805f0652"><ac:plain-text-body><![CDATA[	[[Gong 2003	AA. Bibliography#Gong 03]]	Chapter 6: "Enforcing Security Policy"	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="9865c367ec574b87-f1f39899-45fe45d9-8a718b91-c0680784337dcec6792650bd"><ac:plain-text-body><![CDATA[	[[Lai 2008	AA. Bibliography#Lai 08]]	Java Insecurity: Accounting for Subtleties That Can Compromise Code	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="06f3501cf25629b3-bb777b35-4c0d4c77-a192abf8-f7cffc93e0f1d73e8c4c9fc0"><ac:plain-text-body><![CDATA[	[[McGraw 1999	AA. Bibliography#McGraw 99]]	Chapter Seven Rule 3: "Make Everything Final, Unless There's a Good Reason Not To"	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="bb7dcbb0e0e489ce-ca402e5c-4dcb4e92-a1aa9c9e-4a041c74b0a93eb6ddedebc5"><ac:plain-text-body><![CDATA[	[[Ware 2008	AA. Bibliography#Ware 08]]	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 101

New Version 102

Key

Noncompliant Code Example (Data-Driven Execution)