Stephen de Vries wrote:
>
> With application servers such as Tomcat, WebLogic etc, I think we have a
> special case in that they don't run with the verifier enabled - yet they
> appear to be safe from type confusion attacks. (If you check the
> startup scripts, there's no mention of running with -verify).
OK.
> The difference between the app servers and a regular compiled Java app
> is that the servers load code dynamically and use reflection to access
> fields and methods, so the app servers have no static knowledge of the
> types defined in user code.
Apologies for the above incorrect statement. App servers _do_ have
knowledge of the static type since they define the base classes in the
servlet and other API's.
> The IllegalAccessError is generated when you try and access a private
> method through the reflection API - and since the type checking is done
> dynamically, it would be difficult (impossible?) to perform a type
> confusion attack on code that isn't statically typed. Code below
> illustrates reflection access control in a simple app.
So, I'll rephrase this as: The Tomcat error looks suspiciously like a
reflection access control error, but it could be down to the type
checking done through the dynamic class loading - and not necessarily
the reflection API.
>
>
> package classloader;
>
> import java.lang.reflect.Method;
> import somepackage.MyData;
>
> public class Main {
>
> public Main() {
> }
>
> public static void main(String[] args) {
> try {
>
> Class myClass = MyData.class;
> Object obj = myClass.newInstance();
> Method m = myClass.getDeclaredMethod("getName", new Class[] {});
> System.out.println(m.invoke(obj, new Object[] {}).toString());
> } catch (Exception e) {
> e.printStackTrace();
> }
> }
>
> }
>
> package somepackage;
>
> public class MyData {
> private String name;
>
> public MyData() {
> name = "No one can read me";
> }
>
> private String getName() {
> return name;
> }
> }
>
> Executing the app produces:
>
> java.lang.IllegalAccessException: Class classloader.Main can not access
> a member of class somepackage.MyData with modifiers "private"
> at sun.reflect.Reflection.ensureMemberAccess(Reflection.java:65)
> at java.lang.reflect.Method.invoke(Method.java:578)
> at classloader.Main.main(Main.java:41)
>
>
>
--
Stephen de Vries
Corsaire Ltd
E-mail: stephen_at_corsaire.com
Tel: +44 1483 226014
Fax: +44 1483 226068
Web: http://www.corsaire.com
-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web
application security assessments should be considered a crucial phase in
the development of any web application. What methodology should be
followed? What tools can accelerate the assessment process?
Download this whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701300000007t9h
--------------------------------------------------------------------------
Received on May 11 2006
Intro
