Page Information

Title:	SEC06-J. Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar
Author:	Dhruv Mohindra	Jan 18, 2009
Last Changed by:	David Svoboda	Aug 06, 2025
Tiny Link: (useful for email)	https://wiki.sei.cmu.edu/confluence/x/uzdGBQ
Export As:	Word · PDF

SEI CERT Oracle Coding Standard for Java (1)     Page: SEC05-J. Do not use reflection to increase accessibility of classes, methods, or fields

Parent Page     Page: Rule 15. Platform Security (SEC)

• sec
• cwe-494
• rule
• analyzable

Time	Editor
Aug 06, 2025 17:09	David Svoboda	View Changes
REM cost reform
Jan 14, 2025 09:59	David Svoboda	View Changes
Aug 06, 2021 09:26	Jon O'Donnell	View Changes
Nov 16, 2017 14:43	Will Snavely	View Changes
Jul 01, 2015 18:13	Carol J. Lallier

External Links (15)
    www.securecoding.cert.org/software-updates.jar
    wiki.eclipse.org/JAR_Signing
    java.sun.com/docs/books/tutorial/deployment/jar/jarrunner.h…
    java.sun.com/docs/books/tutorial/deployment/jar/verify.html
    help.eclipse.org/stable/index.jsp?topic=/org.eclipse.platfo…
    cwe.mitre.org/data/definitions/494.html
    java.sun.com/docs/books/tutorial/security/sigcert/index.htm…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    cwe.mitre.org/data/definitions/347.html
    cwe.mitre.org/data/definitions/319.html
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    https://wiki.sei.cmu.edu/confluence/display/java/Rule+AA.+R…
    cwe.mitre.org/data/definitions/300.html
    cwe.mitre.org/

SEI CERT Oracle Coding Standard for Java (4)     Page: ENV00-J. Do not sign code that performs only unprivileged operations     Page: CodeSonar_V     Home page: SEI CERT Oracle Coding Standard for Java     Page: Rule AA. References

SEI CERT C Coding Standard (1)     Page: CodeSonar