1176
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
"Inner Classes" data confidentiality aspects can often be
overcome.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Using sealed classes protects object-oriented encapsulation paradigms and therefore protects
code from being extended in unforeseen ways.
Phase: Implementation
Inner Classes do not provide security. Warning: Never reduce the security of the object from an
outer class, going to an inner class. If an outer class is final or private, ensure that its inner class
is private as well.
Demonstrative Examples
Example 1:
The following Java Applet code mistakenly makes use of an inner class.
Example Language: Java (Bad)
public final class urlTool extends Applet {
private final class urlHelper {
...
}
...
}
Example 2:
The following example shows a basic use of inner classes. The class OuterClass contains the
private member inner class InnerClass. The private inner class InnerClass includes the method
concat that accesses the private member variables of the class OuterClass to output the value
of one of the private member variables of the class OuterClass and returns a string that is a
CWE Version 4.14
CWE-492: Use of Inner Class Containing Sensitive Data
CWE-492: Use of Inner Class Containing Sensitive Data