ABSTRACT

Non-final methods that perform security checks can be overridden in ways that bypass security checks.

EXPLANATION

If a method is overriden by a child class, the child class can bypass security checks in the parent class.
Example 1: In the following code, doSecurityCheck() performs a security check and can be overriden by a child class.


public class BadSecurityCheck {
private int id;

public BadSecurityCheck() {
doSecurityCheck();
id = 1;
}
protected void doSecurityCheck() {
SecurityManager sm = System.getSecurityManager();
if (sm != null) {
sm.checkPermission(new SomePermission("SomeAction"));
}
}
}


REFERENCES

[1] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 358

[2] M. S. Ware, "Writing secure Java code: taxonomy of heuristics and an evaluation of static analysis tools," M.S. Thesis, James Madison University, 2008.

[3] Standards Mapping - FIPS200 - (FISMA) MP