Skip to end of metadata
Go to start of metadata

The following table lists the Java Secure Coding rules and states their applicability to the development of Android applications. Applicable means that the rule can be applied to general Java platforms including Android. Applicable? means that one reviewer found the rule to be applicable to the Android platform, but we are waiting for that to be verified. Applicable in principle means that the rule can be applied to Android but the examples currently shown in the rule are not yet relevant to Android. Not applicable means that the rule cannot be applied to Android platforms.

 

Rule
Applicable to Android Application Development?
Comments
IDS00-J. Sanitize untrusted data passed across a trust boundary

Applicable in principle

The rule uses MS SQL Server as an example to show a database connection. However, on Android, DatabaseHelper from SQLite is used for a database connection. Because Android apps may receive untrusted data via network connections, the rule is applicable.
IDS01-J. Normalize strings before validating themApplicable in principleAndroid apps can receive string data from the outside and normalize it.
IDS02-J. Canonicalize path names before validating themApplicable in principleThe rule is applicable in principle. Please refer to the Android specific instance of this rule: DRD08-J. Always canonicalize a URL received by a content provider.
IDS03-J. Do not log unsanitized user inputApplicable 
IDS04-J. Safely extract files from ZipInputStreamApplicable in principleAlthough not directly a violation of this rule, the Android Master Key vulnerability (insecure use of ZipEntry) is related to this rule. Another attack vector found by a Chinese researcher is also related to this rule.
IDS05-J. Use a subset of ASCII for file and path namesApplicable 
IDS06-J. Exclude unsanitized user input from format stringsApplicable 
IDS07-J. Do not pass untrusted, unsanitized data to the Runtime.exec() methodApplicable in principleRuntime.exec() can be called from Android apps to execute operating system commands.
IDS08-J. Sanitize untrusted data passed to a regexApplicable 
IDS09-J. Do not use locale-dependent methods on locale-dependent data without specifying the appropriate localeApplicable in principleA developer can specify locale on Android using java.util.Locale.
IDS10-J. Do not split characters between two data structuresApplicable 
IDS11-J. Eliminate noncharacter code points before validationApplicable 
IDS12-J. Perform lossless conversion of String data between differing character encodingsApplicable<this is voided>
IDS13-J. Use compatible encodings on both sides of file or network IOApplicable 
DCL00-J. Prevent class initialization cyclesApplicable 
DCL01-J. Do not reuse public identifiers from the Java Standard LibraryApplicable 
DCL02-J. Declare all enhanced for statement loop variables finalApplicable 
EXP00-J. Do not ignore values returned by methodsApplicable 
EXP01-J. Never dereference null pointersApplicable in principleAndroid applications are more sensitive to NullPointerException due to the constraint of the limited mobile device memory. Static members or members of an Activity may become null when memory runs out.
EXP02-J. Use the two-argument Arrays.equals() method to compare the contents of arraysApplicable 
EXP03-J. Do not use the equality operators when comparing values of boxed primitivesApplicable 
EXP04-J. Ensure that autoboxed values have the intended typeApplicable 
EXP05-J. Do not write more than once to the same variable within an expressionApplicable 
EXP06-J. Do not use side-effecting expressions in assertionsApplicable in principleThe assert statement is supported on the Dalvik VM but is ignored under the default configuration. Assertions may be enabled by setting the system property "debug.assert" via: adb shell setprop debug.assert 1 or by sending the command line argument "--enable-assert" to the Dalvik VM.
NUM00-J. Detect or prevent integer overflowApplicable in principle

Mezzofanti for Android contained an integer overflow which prevented the use of a big SD card. Mezzofanti contained an expression:

(int) StatFs.getAvailableBlocks() * (int) StatFs.getBlockSize() 

to calculate the available memory in a SD card, which could result in a negative value when the available memory is bigger than Integer.MAX_VALUE.

Note these methods are deprecated in API level 18 and replaced by getAvailableBlocksLong() and getBlockSizeLong().

NUM01-J. Do not perform bitwise and arithmetic operations on the same dataApplicable 
NUM02-J. Ensure that division and modulo operations do not result in divide-by-zero errorsApplicable 
NUM03-J. Use integer types that can fully represent the possible range of unsigned dataApplicable 
NUM04-J. Do not use floating-point numbers if precise computation is requiredApplicable in principleThe use of floating-point is not recommended for performance reasons on Android.
NUM05-J. Do not use denormalized numbersApplicable 
NUM06-J. Use the strictfp modifier for floating-point calculation consistency across platformsApplicable in principle 
NUM07-J. Do not attempt comparisons with NaNApplicable 
NUM08-J. Check floating-point inputs for exceptional valuesApplicable 
NUM09-J. Do not use floating-point variables as loop countersApplicable 
NUM10-J. Do not construct BigDecimal objects from floating-point literalsApplicable 
NUM11-J. Do not compare or inspect the string representation of floating-point valuesApplicable in principleComparing or inspecting the string representation of floating-point values may have unexpected results on Android.
NUM12-J. Ensure conversions of numeric types to narrower types do not result in lost or misinterpreted dataApplicable 
NUM13-J. Avoid loss of precision when converting primitive integers to floating-pointApplicable 
OBJ00-J. Limit extensibility of classes and methods with invariantsApplicable 
OBJ01-J. Declare data members as private and provide accessible wrapper methodsApplicable 
OBJ02-J. Preserve dependencies in subclasses when changing superclassesApplicable 
OBJ03-J. Do not mix generic with nongeneric raw types in new codeApplicable 
OBJ04-J. Provide mutable classes with copy functionality to safely allow passing instances to untrusted codeApplicable 
OBJ05-J. Defensively copy private mutable class members before returning their referencesApplicable 
OBJ06-J. Defensively copy mutable inputs and mutable internal componentsApplicable 
OBJ07-J. Sensitive classes must not let themselves be copiedApplicable 
OBJ08-J. Do not expose private members of an outer class from within a nested classApplicable 
OBJ09-J. Compare classes and not class namesApplicable 
OBJ10-J. Do not use public static nonfinal variablesApplicable 
OBJ11-J. Be wary of letting constructors throw exceptionsApplicable 
MET00-J. Validate method argumentsApplicable 
MET01-J. Never use assertions to validate method argumentsApplicable in principleThe assert statement is supported on the Dalvik VM but is ignored under the default configuration. Assertions may be enabled by setting the system property "debug.assert" via: adb shell setprop debug.assert 1 or by sending the command line argument "--enable-assert" to the Dalvik VM.
MET02-J. Do not use deprecated or obsolete classes or methodsApplicable in principleThe Android SDK also has deprecated or obsolete APIs. Also, there may exist incompatible APIs depending on the SDK version. Therefore, it is recommended that developers refer to the "Android API Difference report" and consider replacing the deprecated APIs.
MET03-J. Methods that perform a security check must be declared private or finalApplicable in principleOn Android, System.getSecurityManager() is not used and the use of a Security Manager is not exercised. However, an Android developer can implement security-sensitive methods so the principle may be applicable on Android.
MET04-J. Do not increase the accessibility of overridden or hidden methodsApplicable 
MET05-J. Ensure that constructors do not call overridable methodsApplicable 
MET06-J. Do not invoke overridable methods in clone()Applicable 
MET07-J. Never declare a class method that hides a method declared in a superclass or superinterfaceApplicable 
MET08-J. Preserve the equality contract when overriding the equals() methodApplicable 
MET09-J. Classes that define an equals() method must also define a hashCode() methodApplicable<bjw pickup>
MET10-J. Follow the general contract when implementing the compareTo() methodApplicable 
MET11-J. Ensure that keys used in comparison operations are immutableApplicable 
MET12-J. Do not use finalizersApplicable 
ERR00-J. Do not suppress or ignore checked exceptionsApplicable 
ERR01-J. Do not allow exceptions to expose sensitive informationApplicable 
ERR02-J. Prevent exceptions while logging dataApplicable 
ERR03-J. Restore prior object state on method failureApplicable 
ERR04-J. Do not complete abruptly from a finally blockApplicable 
ERR05-J. Do not let checked exceptions escape from a finally blockApplicable 
ERR06-J. Do not throw undeclared checked exceptionsApplicable 
ERR07-J. Do not throw RuntimeException, Exception, or ThrowableApplicable 
ERR08-J. Do not catch NullPointerException or any of its ancestorsApplicable 
ERR09-J. Do not allow untrusted code to terminate the JVMApplicable in principleOn Android, System.exit() should not be used because it will terminate the virtual machine abruptly, ignoring the activity lifecycle which may prevent proper garbage collection.
VNA00-J. Ensure visibility when accessing shared primitive variablesApplicable 
VNA01-J. Ensure visibility of shared references to immutable objectsApplicable 
VNA02-J. Ensure that compound operations on shared variables are atomicApplicable 
VNA03-J. Do not assume that a group of calls to independently atomic methods is atomicApplicable 
VNA04-J. Ensure that calls to chained methods are atomicApplicable 
VNA05-J. Ensure atomicity when reading and writing 64-bit valuesApplicable 
LCK00-J. Use private final lock objects to synchronize classes that may interact with untrusted codeApplicable in principle 
LCK01-J. Do not synchronize on objects that may be reusedApplicable 
LCK02-J. Do not synchronize on the class object returned by getClass()Applicable 
LCK03-J. Do not synchronize on the intrinsic locks of high-level concurrency objectsApplicable 
LCK04-J. Do not synchronize on a collection view if the backing collection is accessibleApplicable 
LCK05-J. Synchronize access to static fields that can be modified by untrusted codeApplicable in principle 
LCK06-J. Do not use an instance lock to protect shared static dataApplicable 
LCK07-J. Avoid deadlock by requesting and releasing locks in the same orderApplicable 
LCK08-J. Ensure actively held locks are released on exceptional conditionsApplicable 
LCK09-J. Do not perform operations that can block while holding a lockApplicable 
LCK10-J. Do not use incorrect forms of the double-checked locking idiomApplicable 
LCK11-J. Avoid client-side locking when using classes that do not commit to their locking strategyApplicable in principle 
THI00-J. Do not invoke Thread.run()ApplicableAndroid provides a couple of solutions for threading. The Android Developers Blog's article "Painless threading" discusses those solutions.
THI01-J. Do not invoke ThreadGroup methodsApplicable 
THI02-J. Notify all waiting threads rather than a single threadApplicable in principle 
THI03-J. Always invoke wait() and await() methods inside a loopApplicable in principle 
THI04-J. Ensure that threads performing blocking operations can be terminatedApplicable in principle 
THI05-J. Do not use Thread.stop() to terminate threadsApplicableOn Android, Thread.stop() was deprecated in API level 1.
TPS00-J. Use thread pools to enable graceful degradation of service during traffic burstsApplicable in principle 
TPS01-J. Do not execute interdependent tasks in a bounded thread poolApplicable in principle 
TPS02-J. Ensure that tasks submitted to a thread pool are interruptibleApplicable in principle 
TPS03-J. Ensure that tasks executing in a thread pool do not fail silentlyApplicable in principle 
TPS04-J. Ensure ThreadLocal variables are reinitialized when using thread poolsApplicable in principle 
TSM00-J. Do not override thread-safe methods with methods that are not thread-safeApplicable in principle 
TSM01-J. Do not let the this reference escape during object constructionApplicable in principle 
TSM02-J. Do not use background threads during class initializationApplicable in principle 
TSM03-J. Do not publish partially initialized objectsApplicable 
FIO00-J. Do not operate on files in shared directoriesApplicable in principleOn Android, the SD card ( /sdcard or /mnt/sdcard ) is shared among multiple applications, thus sensitive files should not be stored on the SD card.
FIO01-J. Create files with appropriate access permissionsApplicable in principleCreating files with weak permissions may allow malicious applications to access the files.
FIO02-J. Detect and handle file-related errorsApplicable 
FIO03-J. Remove temporary files before terminationApplicable 
FIO04-J. Release resources when they are no longer neededApplicable in principleThe compliant solution (Java SE 7: try-with-resources) is not yet supported at API level 18 (Android 4.3).
FIO05-J. Do not expose buffers created using the wrap() or duplicate() methods to untrusted codeApplicable 
FIO06-J. Do not create multiple buffered wrappers on a single InputStreamApplicable in principle 
FIO07-J. Do not let external processes block on IO buffersApplicable 
FIO08-J. Use an int to capture the return value of methods that read a character or byteApplicable 
FIO09-J. Do not rely on the write() method to output integers outside the range 0 to 255Applicable 
FIO10-J. Ensure the array is filled when using read() to fill an arrayApplicable 
FIO11-J. Do not attempt to read raw binary data as character dataApplicable 
FIO12-J. Provide methods to read and write little-endian dataApplicable 
FIO13-J. Do not log sensitive information outside a trust boundaryApplicable in principleDRD04-J. Do not log sensitive information is an Android specific instance of this rule.
FIO14-J. Perform proper cleanup at program terminationApplicable in principleAlthough most of the code examples are not applicable to the Android platform, the principle is applicable to Android. There are a number of ways to terminate a process on Android: android.app.Activity.finish(), and the related finish... methods, android.app.Activity.moveTaskToBack(boolean flag), android.os.Process.killProcess(int pid), System.exit().
FIO15-J. Do not operate on untrusted file linksApplicable in principle 
SER00-J. Enable serialization compatibility during class evolutionApplicable 
SER01-J. Do not deviate from the proper signatures of serialization methodsApplicable 
SER02-J. Sign then seal sensitive objects before sending them outside a trust boundaryApplicable 
SER03-J. Do not serialize unencrypted, sensitive dataApplicable 
SER04-J. Do not allow serialization and deserialization to bypass the security managerNot applicableThe java.security package exists on Android for compatibility purposes only and it should not be used.
SER05-J. Do not serialize instances of inner classesApplicable 
SER06-J. Make defensive copies of private mutable components during deserializationApplicable 
SER07-J. Do not use the default serialized form for classes with implementation-defined invariantsApplicable 
SER08-J. Minimize privileges before deserializing from a privileged contextApplicable 
SER09-J. Do not invoke overridable methods from the readObject() methodApplicable 
SER10-J. Avoid memory and resource leaks during serializationApplicable 
SER11-J. Prevent overwriting of externalizable objectsApplicable 
SEC00-J. Do not allow privileged blocks to leak sensitive information across a trust boundaryNot applicableThe java.security package exists on Android for compatibility purposes only and it should not be used.
SEC01-J. Do not allow tainted variables in privileged blocksApplicable in principleThe code examples using the java.security package are not applicable to Android but the principle of the rule is applicable to Android apps.
SEC02-J. Do not base security checks on untrusted sourcesApplicable in principleThe code examples using the java.security package are not applicable to Android but the principle of the rule is applicable to Android apps.
SEC03-J. Do not load trusted classes after allowing untrusted code to load arbitrary classesApplicable in principleOn Android, the use of DexClassLoader or PathClassLoader requires caution.
SEC04-J. Protect sensitive operations with security manager checksNot applicableThe java.security package exists on Android for compatibility purposes only and it should not be used.
SEC05-J. Do not use reflection to increase accessibility of classes, methods, or fieldsApplicable in principleReflection can be used on Android so the rule is applicable. Also the use of reflection may allow a developer to access private Android APIs and so requires caution.
SEC06-J. Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jarNot applicable 
SEC07-J. Call the superclass's getPermissions() method when writing a custom class loaderNot applicableThe java.security package exists on Android for compatibility purposes only and it should not be used.
JNI00-J. Define wrappers around native methodsApplicable 
 JNI02-J. Do not assume object references are constant or uniqueApplicable 
 JNI03-J. Do not use direct pointers to Java objects in JNI codeApplicable in principle Applicable to API versions 14 and above, with NDK versions 7 and above.
 JNI04-J. Do not assume that Java strings are null-terminatedApplicable 
ENV00-J. Do not sign code that performs only unprivileged operationsNot applicableThe Android system uses code signing as a means of identifying the author of an application and establishing trust relationships between applications, not as a means of granting elevated privileges to code.
ENV01-J. Place all security-sensitive code in a single JAR and sign and seal itNot applicable java.security.AccessController exists on Android for compatibility purposes only and it should not be used.
ENV02-J. Do not trust the values of environment variablesApplicable in principleOn Android, the environment variable user.name is not used and is left blank. However, environment variables exist and are used on Android so the rule is applicable.
ENV03-J. Do not grant dangerous combinations of permissionsNot applicableThe java.security package exists on Android for compatibility purposes only and it should not be used. Android uses another permission mechanism for security purposes.
ENV04-J. Do not disable bytecode verificationApplicable in principleUnder the default settings, bytecode verification is enabled on the Dalvik VM. To change the settings use the adb shell to set the appropriate system property, for example: adb shell setprop dalvik.vm.dexopt-flags v=a or pass -Xverify:all as an argument to the Dalvik VM.
ENV05-J. Do not deploy an application that can be remotely monitoredNot applicableJVMTI is not supported on the Dalvik VM.
MSC00-J. Use SSLSocket rather than Socket for secure data exchangeApplicable 
MSC01-J. Do not use an empty infinite loopApplicable 
MSC02-J. Generate strong random numbersApplicable 
MSC03-J. Never hard code sensitive informationApplicable in principleHard coded information can be easily obtained on Android by using the apktool to decompile an application or by using dex2jar to convert a dex file to a jar file.
MSC04-J. Do not leak memoryApplicable 
MSC05-J. Do not exhaust heap spaceApplicable 
MSC06-J. Do not modify the underlying collection when an iteration is in progressApplicable 
MSC07-J. Prevent multiple instantiations of singleton objectsApplicable 

 

Applicable in principle