Enforcing Secure Object Initialization in Java

Details Enforcing Secure Object Initialization in Java Enforcing Secure Object Initialization in Java

2010-07-19

arxiv.org/abs/1007.3133v1

15th European Symposium on Research in Computer Security (ESORICS) 6345 (2010) 101-115

Computer Science

Programming Languages

Scientific paper

Sun and the CERT recommend for secure Java development to not allow partially initialized objects to be accessed. The CERT considers the severity of the risks taken by not following this recommendation as high. The solution currently used to enforce object initialization is to implement a coding pattern proposed by Sun, which is not formally checked. We propose a modular type system to formally specify the initialization policy of libraries or programs and a type checker to statically check at load time that all loaded classes respect the policy. This allows to prove the absence of bugs which have allowed some famous privilege escalations in Java. Our experimental results show that our safe default policy allows to prove 91% of classes of java.lang, java.security and javax.security safe without any annotation and by adding 57 simple annotations we proved all classes but four safe. The type system and its soundness theorem have been formalized and machine checked using Coq.

Affiliated with

Also associated with

No associations

Rating

Enforcing Secure Object Initialization in Java does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.

If you have personal experience with Enforcing Secure Object Initialization in Java, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Enforcing Secure Object Initialization in Java will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFWR-SCP-O-62251