JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
Java

JAVA.CLASS.ICL : Insecure Class Loader (Java)

要旨

The java.lang.ClassLoader class is used.

Class loaders provide classes to a running Java Virtual Machine. The classical java.lang.ClassLoader class has no strong support for security, while class java.security.SecureClassLoader has additional support for defining classes with an associated code source and permissions.

プロパティ

クラス名 Insecure Class Loader (Java)
日本語クラス名 Insecure Class Loader (Java)
クラス分類 信頼性 (reliability)
ニーモニック JAVA.CLASS.ICL
カテゴリー
CWE CWE:913 Improper Control of Dynamically-Managed Code Resources
対応言語 Available for Java and Kotlin.
有効/無効設定 このワーニングクラスのチェックはデフォルトで無効になっています。チェックを有効にするにはプロジェクト設定ファイル （configuration file）に以下の WARNING_FILTER ルールを追加してください。 
WARNING_FILTER += allow class="Insecure Class Loader (Java)"

例 

public class Unsafe extends ClassLoader {  // "Insecure Class Loader (Java)" warning issued here

  @Override
  public Class<?> loadClass(String name) throws ClassNotFoundException {
    System.out.println("I have been requested to load " + name);
    return super.loadClass(name);
  }
}

In this example, the programmer should subclass the safer java.security.SecureClassLoader class: 

public class Safe extends java.security.SecureClassLoader {

  @Override
  public Class<?> loadClass(String name) throws ClassNotFoundException {
    System.out.println("I have been requested to load " + name);
    return super.loadClass(name);
  }
}

解決法

Subclass java.security.SecureClassLoader instead of java.lang.ClassLoader.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。

 

To report problems with this documentation, please visit https://support.codesecure.com/.