1308
functions could compromise security and decrease the container's ability to properly manage the
runtime environment."
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 573 Improper Following of Specification by Caller 1298
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Other
Execute Unauthorized Code or Commands
Varies by Context
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Do not use the Class Loader when writing EJBs.
Demonstrative Examples
Example 1:
The following Java example is a simple stateless Enterprise JavaBean that retrieves the interest
rate for the number of points for a mortgage. The interest rates for various points are retrieved from
an XML document on the local file system, and the EJB uses the Class Loader for the EJB class to
obtain the XML document from the local file system as an input stream.
Example Language: Java (Bad)
@Stateless
public class InterestRateBean implements InterestRateRemote {
private Document interestRateXMLDocument = null;
public InterestRateBean() {
try {
// get XML document from the local filesystem as an input stream
// using the ClassLoader for this class
ClassLoader loader = this.getClass().getClassLoader();
InputStream in = loader.getResourceAsStream(Constants.INTEREST_RATE_FILE);
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
interestRateXMLDocument = db.parse(interestRateFile);
} catch (IOException ex) {...}
}
public BigDecimal getInterestRate(Integer points) {
return getInterestRateFromXML(points);
}
/* member function to retrieve interest rate from XML document on the local file system */
private BigDecimal getInterestRateFromXML(Integer points) {...}
}
CWE Version 4.14
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session