Page History

...

Code Block

bgColor	#FFcccc

public class SensitiveClass extends Exception {
  public static final SensitiveClass INSTANCE = new SensitiveClass();
  private SensitiveClass() {
    // Perform security checks and parameter validation
  }

  protected int printBalance() {
    int balance = 1000;
    return balance;
  }
}

class Malicious {
  public static void main(String[] args) {
    SensitiveClass sc = (SensitiveClass) deepCopy(SensitiveClass.INSTANCE);
    System.out.println(sc == SensitiveClass.INSTANCE);  // Prints false; indicates new instance
    System.out.println("Balance = " + sc.printBalance());
  }

  // This method should not be used in production quality code
  static public Object deepCopy(Object obj) {
    try {
      ByteArrayOutputStream bos = new ByteArrayOutputStream();
      new ObjectOutputStream(bos).writeObject(obj);
      ByteArrayInputStream bin = new ByteArrayInputStream(bos.toByteArray());
      return new ObjectInputStream(bin).readObject();
    } catch (Exception e) { 
      throw new IllegalArgumentException(e);
    }
  }
}

See rule MSC11-J. Address the shortcomings of the Singleton design patternPrevent multiple instantiations of singleton objects for more information on singletons.

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="68e18143ef45a0ad-0f4c4494-4fc3423d-9da497d3-ee19d62ee3ec6ef5e005f450"><ac:plain-text-body><![CDATA[	[[Bloch 2005	AA. Bibliography#Bloch 05]]	Puzzle 83: Dyslexic Monotheism	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="06dff74ac1374ec4-d0ae91e6-4a98482f-831f967b-996c68a18daf319f2101e889"><ac:plain-text-body><![CDATA[	[[Bloch 2001	AA. Bibliography#Bloch 01]]	Item 1: Enforce the singleton property with a private constructor	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="cc61718ebc0885da-c991b6b1-4e3e4016-a86c8e24-9a986cd4b1d992277967576e"><ac:plain-text-body><![CDATA[	[[Greanier 2000	AA. Bibliography#Greanier 00]]	[Discover the secrets of the Java Serialization API	http://java.sun.com/developer/technicalArticles/Programming/serialization/]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a705f87267ec6357-733b21b8-48fa468c-b5ba91d4-d39a3ff0d4e75bb086ed730a"><ac:plain-text-body><![CDATA[	[[Harold 1999	AA. Bibliography#Harold 99]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="404d62a33297c605-7f978681-469b4ba4-8c6fbb03-b17985184bb8725ec84cb48b"><ac:plain-text-body><![CDATA[	[[JLS 2005	AA. Bibliography#JLS 05]]	[Transient modifier	http://java.sun.com/docs/books/jls/third_edition/html/classes.html#37020]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="fe6d492d559d0965-fa8cc17d-400f4e6e-8afd8225-f40ed2ed709c9c8869c325b6"><ac:plain-text-body><![CDATA[	[[Long 2005	AA. Bibliography#Long 05]]	Section 2.4, Serialization	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="689b02acf95848cd-d17258e5-455249c2-9cac8879-bed4d24843959f65d5bf4e0c"><ac:plain-text-body><![CDATA[	[[Sun 2006	AA. Bibliography#Sun 06]]	"Serialization specification: A.4 Preventing Serialization of Sensitive Data"	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 92

New Version 93

Key