Page History

...

class BadScope {
  protected final void doLogic() { // declare as final 
    System.out.println("Super invoked");
    // Do sensitive operations
  }
}

Noncompliant Code Example

This noncompliant code example overrides the finalize() method of the superclass Base, changing its accessibility from protected to public.

According to Sun's Secure Coding Guidelines [[SCG 2007]]

In addition, refrain from increasing the accessibility of an inherited method, as doing so may break assumptions made by the superclass. A class that overrides the protected java.lang.Object.finalize method and declares that method public, for example, enables hostile callers to finalize an instance of that class, and to call methods on that instance after it has been finalized. A superclass implementation unprepared to handle such a call sequence could throw runtime exceptions that leak private information, or that leave the object in an invalid state that compromises security.

final class SubClass extends Base {
  public void finalize() {
    // ...
  }
}

Compliant Solution

This compliant solution correctly declares the finalize() method protected. It is not possible to further limit the accessibility as Object's finalize method itself is declared protected.

final class SubClass extends Base {
  protected void finalize() {
    // ... 
  }
}

It is recommended but not mandatory to limit the accessibility of a subclass's constructor to that of the superclass's constructor.

Exceptions

Exceptions

MET17-EX0SPC01-EX1: According to Sun's Secure Coding Guidelines [[SCG 2007]]

...