Rule 15. Platform Security (SEC)

Rules

• Page:
  SEC00-J. Do not allow privileged blocks to leak sensitive information across a trust boundary
• Page:
  SEC01-J. Do not allow tainted variables in privileged blocks
• Page:
  SEC02-J. Do not base security checks on untrusted sources
• Page:
  SEC03-J. Do not load trusted classes after allowing untrusted code to load arbitrary classes
• Page:
  SEC04-J. Protect sensitive operations with security manager checks
• Page:
  SEC05-J. Do not use reflection to increase accessibility of classes, methods, or fields
• Page:
  SEC06-J. Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar
• Page:
  SEC07-J. Call the superclass's getPermissions() method when writing a custom class loader
• Page:
  SEC08-J Trusted code must discard or clean any arguments provided by untrusted code
• Page:
  SEC09-J Never leak the results of certain standard API methods from trusted code to untrusted code
• Page:
  SEC10-J Never permit untrusted code to invoke any API that may (possibly transitively) invoke the reflection APIs

Risk Assessment Summary