Reino: Security Features

Segurança de software não é o mesmo que software de segurança. Aqui, estamos interessados em tópicos como autenticação, controle de acesso, confidencialidade, criptografia e gestão de privilégios.

Privilege Management: Overly Broad Access Specifier

Java/JSP

Abstract

O código privilegiado em métodos public pode ser chamado de qualquer lugar na JVM.

Explanation

Princípios de codificação segura defendem tornar especificadores de acesso os mais restritivos possíveis. Um método com um especificador de acesso public significa que qualquer código externo pode chamá-lo. Métodos públicos que realizam ações privilegiadas podem ser perigosos quando o código é compartilhado em bibliotecas ou em ambientes nos quais o código pode entrar dinamicamente no sistema (por exemplo, Injeção de Código, Inclusão de Arquivos Perigosos, Carregamento de arquivo etc).

Exemplo 1: No código a seguir, doPrivilegedOpenFile() é declarado como public e realiza uma operação privilegiada.


public static void doPrivilegedOpenFile(final String filePath) {
final BadFileNamePrivilegedAction pa = new BadFileNamePrivilegedAction(filePath);

FileInputStream fis = null;
...
fis = (FileInputStream)AccessController.doPrivileged(pa);
...
}

References

[1] Secure Coding Guidelines for the Java Programming Language, version 2.0 Sun Microsystems, Inc.

[2] M. S. Ware Writing secure Java code: taxonomy of heuristics and an evaluation of static analysis tools

[3] FUNDAMENTALS-3: Restrict privileges Oracle

[4] ACCESS-3: Safely invoke java.security.AccessController.doPrivileged Oracle

[5] Standards Mapping - Common Weakness Enumeration CWE ID 749

[6] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000381, CCI-002233, CCI-002235

[7] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[8] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-6 Least Privilege (P1), CM-7 Least Functionality (P1)

[9] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-6 Least Privilege, CM-7 Least Functionality

[10] Standards Mapping - OWASP Application Security Verification Standard 4.0 14.5.1 Validate HTTP Request Header Requirements (L1 L2 L3)

[11] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[12] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[13] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.7, Requirement 7.2

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.10

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.10

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.10

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.10

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[24] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[25] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[47] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

[48] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization

desc.structural.java.privilege_management_overly_broad_access_specifier