CWE-579 J2EE不安全实践:将不可序列化的对象存储在会话中

admin 2021年11月4日23:16:22评论175 views字数 1386阅读4分37秒阅读模式

CWE-579 J2EE不安全实践:将不可序列化的对象存储在会话中

J2EE Bad Practices: Non-serializable Object Stored in Session

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

The application stores a non-serializable object as an HttpSession attribute, which can hurt reliability.

扩展描述

A J2EE application can make use of multiple JVMs in order to improve application reliability and performance. In order to make the multiple JVMs appear as a single application to the end user, the J2EE container can replicate an HttpSession object across multiple JVMs so that if one JVM becomes unavailable another can step in and take its place without disrupting the flow of the application. This is only possible if all session data is serializable, allowing the session to be duplicated between the JVMs.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 573 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 573 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Name': 'Java', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Other Quality Degradation

可能的缓解方案

Implementation

策略:

In order for session replication to work, the values the application stores as attributes in the session must implement the Serializable interface.

示例代码

The following class adds itself to the session, but because it is not serializable, the session can no longer be replicated.

bad Java

public class DataGlob {

String globName;
String globValue;

public void addToSession(HttpSession session) {

session.setAttribute("glob", this);

}

}

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
Software Fault Patterns SFP1 Glitch in computation

文章来源于互联网:scap中文网

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2021年11月4日23:16:22
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   CWE-579 J2EE不安全实践:将不可序列化的对象存储在会话中http://cn-sec.com/archives/613098.html

发表评论

匿名网友 填写信息