{"@ID": "492", "@Name": "Use of Inner Class Containing Sensitive Data", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Draft", "Description": "Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.", "Extended_Description": "Inner classes quietly introduce several security concerns because of the way they are translated into Java bytecode. In Java source code, it appears that an inner class can be declared to be accessible only by the enclosing class, but Java bytecode has no concept of an inner class, so the compiler must transform an inner class declaration into a peer class with package level access to the original outer class. More insidiously, since an inner class can access private fields in its enclosing class, once an inner class becomes a peer class in bytecode, the compiler converts private fields accessed by the inner class into protected fields.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "668", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Name": "Java", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Likelihood_Of_Exploit": "Medium", "Common_Consequences": {"Consequence": {"Scope": "Confidentiality", "Impact": "Read Application Data", "Note": "\"Inner Classes\" data confidentiality aspects can often be overcome."}}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Implementation", "Description": "Using sealed classes protects object-oriented encapsulation paradigms and therefore protects code from being extended in unforeseen ways."}, {"Phase": "Implementation", "Description": "Inner Classes do not provide security. Warning: Never reduce the security of the object from an outer class, going to an inner class. If an outer class is final or private, ensure that its inner class is private as well."}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"Intro_Text": "The following Java Applet code mistakenly makes use of an inner class.", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "#text": "..."}, "xhtml:br": null, "#text": "private final class urlHelper {}..."}, "#text": "public final class urlTool extends Applet {}"}, "#text_blocks": ["public final class urlTool extends Applet {", "private final class urlHelper {", "...", "}", "...", "}"]}}, {"Intro_Text": "The following example shows a basic use of inner classes. The class OuterClass contains the private member inner class InnerClass. The private inner class InnerClass includes the method concat that accesses the private member variables of the class OuterClass to output the value of one of the private member variables of the class OuterClass and returns a string that is a concatenation of one of the private member variables of the class OuterClass, the separator input parameter of the method and the private member variable of the class InnerClass.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:i": ["// private member variables of OuterClass", "// constructor of OuterClass", "// InnerClass is a member inner class of OuterClass"], "xhtml:br": [null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "this.memberOne = varOne;this.memberTwo = varTwo;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "this.innerMemberOne = innerVarOne;"}, {"@style": "margin-left:1em;", "xhtml:i": "// InnerClass has access to private member variables of OuterClass", "xhtml:br": [null, null], "#text": "System.out.println(\"Value of memberOne is: \" + memberOne);return OuterClass.this.memberTwo + separator + this.innerMemberOne;"}], "#text": "private String innerMemberOne;\n                           public InnerClass(String innerVarOne) {}\n                           public String concat(String separator) {}"}], "#text": "private String memberOne;private String memberTwo;\n                        \n                        \n                        public OuterClass(String varOne, String varTwo) {}\n                        \n                        \n                        private class InnerClass {}"}, "#text": "public class OuterClass {}"}, "#text_blocks": ["public class OuterClass {", "// private member variables of OuterClass", "private String memberOne;", "private String memberTwo;", "// constructor of OuterClass", "public OuterClass(String varOne, String varTwo) {", "this.memberOne = varOne;", "this.memberTwo = varTwo;", "}", "// InnerClass is a member inner class of OuterClass", "private class InnerClass {", "private String innerMemberOne;", "public InnerClass(String innerVarOne) {", "this.innerMemberOne = innerVarOne;", "}", "public String concat(String separator) {", "// InnerClass has access to private member variables of OuterClass", "System.out.println(\"Value of memberOne is: \" + memberOne);", "return OuterClass.this.memberTwo + separator + this.innerMemberOne;", "}", "}", "}"]}, {"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null], "xhtml:i": ["// private member variables of OuterClass", "// constructor of OuterClass", "// InnerClass is a static inner class of OuterClass"], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "this.memberOne = varOne;this.memberTwo = varTwo;"}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "this.innerMemberOne = innerVarOne;"}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:i": "// InnerClass only has access to static member variables of OuterClass", "xhtml:br": null, "#text": "return memberTwo + separator + this.innerMemberOne;"}}], "#text": "private String innerMemberOne;\n                                 public InnerClass(String innerVarOne) {}public String concat(String separator) {}"}}], "#text": "private String memberOne;private static String memberTwo;\n                           \n                           \n                           public OuterClass(String varOne, String varTwo) {\n                           }\n                           \n                           \n                           private static class InnerClass {}"}}, "#text": "public class OuterClass {\n                     }"}, "#text_blocks": ["public class OuterClass {", "// private member variables of OuterClass", "private String memberOne;", "private static String memberTwo;", "// constructor of OuterClass", "public OuterClass(String varOne, String varTwo) {", "this.memberOne = varOne;", "this.memberTwo = varTwo;", "}", "// InnerClass is a static inner class of OuterClass", "private static class InnerClass {", "private String innerMemberOne;", "public InnerClass(String innerVarOne) {", "this.innerMemberOne = innerVarOne;", "}", "public String concat(String separator) {", "// InnerClass only has access to static member variables of OuterClass", "return memberTwo + separator + this.innerMemberOne;", "}", "}", "}"]}], "Body_Text": ["Although this is an acceptable use of inner classes it demonstrates one of the weaknesses of inner classes that inner classes have complete access to all member variables and methods of the enclosing class even those that are declared private and protected. When inner classes are compiled and translated into Java bytecode the JVM treats the inner class as a peer class with package level access to the enclosing class.", "To avoid this weakness of inner classes, consider using either static inner classes, local inner classes, or anonymous inner classes.", "The following Java example demonstrates the use of static inner classes using the previous example. The inner class InnerClass is declared using the static modifier that signifies that InnerClass is a static member of the enclosing class OuterClass. By declaring an inner class as a static member of the enclosing class, the inner class can only access other static members and methods of the enclosing class and prevents the inner class from accessing nonstatic member variables and methods of the enclosing class. In this case the inner class InnerClass can only access the static member variable memberTwo of the enclosing class OuterClass but cannot access the nonstatic member variable memberOne.", "The only limitation with using a static inner class is that as a static member of the enclosing class the inner class does not have a reference to instances of the enclosing class. For many situations this may not be ideal. An alternative is to use a local inner class or an anonymous inner class as shown in the next examples."]}, {"Intro_Text": "In the following example the BankAccount class contains the private member inner class InterestAdder that adds interest to the bank account balance. The start method of the BankAccount class creates an object of the inner class InterestAdder, the InterestAdder inner class implements the ActionListener interface with the method actionPerformed. A Timer object created within the start method of the BankAccount class invokes the actionPerformed method of the InterestAdder class every 30 days to add the interest to the bank account balance based on the interest rate passed to the start method as an input parameter. The inner class InterestAdder needs access to the private member variable balance of the BankAccount class in order to add the interest to the bank account balance.", "Body_Text": ["However as demonstrated in the previous example, because InterestAdder is a non-static member inner class of the BankAccount class, InterestAdder also has access to the private member variables of the BankAccount class - including the sensitive data contained in the private member variables for the bank account owner's name, Social Security number, and the bank account number.", "In the following example the InterestAdder class from the above example is declared locally within the start method of the BankAccount class. As a local inner class InterestAdder has its scope restricted to the method (or enclosing block) where it is declared, in this case only the start method has access to the inner class InterestAdder, no other classes including the enclosing class has knowledge of the inner class outside of the start method. This allows the inner class to access private member variables of the enclosing class but only within the scope of the enclosing method or block.", "A similar approach would be to use an anonymous inner class as demonstrated in the next example. An anonymous inner class is declared without a name and creates only a single instance of the inner class object. As in the previous example the anonymous inner class has its scope restricted to the start method of the BankAccount class."], "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:i": ["// private member variables of BankAccount class", "// constructor for BankAccount class", "// start method will add interest to balance every 30 days", "// creates timer object and interest adding action listener object", "// InterestAdder is an inner class of BankAccount class", "// that implements the ActionListener interface"], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "#text": "this.accountOwnerName = accountOwnerName;this.accountOwnerSSN = accountOwnerSSN;this.accountNumber = accountNumber;this.balance = initialBalance;this.start(initialRate);"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "ActionListener adder = new InterestAdder(rate);Timer t = new Timer(1000 * 3600 * 24 * 30, adder);t.start();"}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "this.rate = aRate;"}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:i": "// update interest", "xhtml:br": [null, null], "#text": "double interest = BankAccount.this.balance * rate / 100;BankAccount.this.balance += interest;"}}], "#text": "private double rate;\n                                 public InterestAdder(double aRate){}\n                                 public void actionPerformed(ActionEvent event){}"}}], "#text": "private String accountOwnerName;private String accountOwnerSSN;private int accountNumber;private double balance;\n                           \n                           \n                           public BankAccount(String accountOwnerName, String accountOwnerSSN,int accountNumber, double initialBalance, int initialRate){}\n                           \n                           \n                           \n                           \n                           \n                           public void start(double rate){}\n                           \n                           \n                           \n                           \n                           \n                           private class InterestAdder implements ActionListener{}"}}, "#text": "public class BankAccount {}"}, "#text_blocks": ["public class BankAccount {", "// private member variables of BankAccount class", "private String accountOwnerName;", "private String accountOwnerSSN;", "private int accountNumber;", "private double balance;", "// constructor for BankAccount class", "public BankAccount(String accountOwnerName, String accountOwnerSSN,", "int accountNumber, double initialBalance, int initialRate)", "{", "this.accountOwnerName = accountOwnerName;", "this.accountOwnerSSN = accountOwnerSSN;", "this.accountNumber = accountNumber;", "this.balance = initialBalance;", "this.start(initialRate);", "}", "// start method will add interest to balance every 30 days", "// creates timer object and interest adding action listener object", "public void start(double rate)", "{", "ActionListener adder = new InterestAdder(rate);", "Timer t = new Timer(1000 * 3600 * 24 * 30, adder);", "t.start();", "}", "// InterestAdder is an inner class of BankAccount class", "// that implements the ActionListener interface", "private class InterestAdder implements ActionListener", "{", "private double rate;", "public InterestAdder(double aRate)", "{", "this.rate = aRate;", "}", "public void actionPerformed(ActionEvent event)", "{", "// update interest", "double interest = BankAccount.this.balance * rate / 100;", "BankAccount.this.balance += interest;", "}", "}", "}"]}, {"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:i": ["// private member variables of BankAccount class", "// constructor for BankAccount class", "// start method will add interest to balance every 30 days", "// creates timer object and interest adding action listener object"], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "#text": "this.accountOwnerName = accountOwnerName;this.accountOwnerSSN = accountOwnerSSN;this.accountNumber = accountNumber;this.balance = initialBalance;this.start(initialRate);"}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null], "xhtml:i": ["// InterestAdder is a local inner class", "// that implements the ActionListener interface"], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:i": "// update interest", "xhtml:br": [null, null], "#text": "double interest = BankAccount.this.balance * rate / 100;BankAccount.this.balance += interest;"}}, "#text": "public void actionPerformed(ActionEvent event){}"}}, "#text": "class InterestAdder implements ActionListener{}ActionListener adder = new InterestAdder();Timer t = new Timer(1000 * 3600 * 24 * 30, adder);t.start();"}}], "#text": "private String accountOwnerName;private String accountOwnerSSN;private int accountNumber;private double balance;\n                           \n                           \n                           public BankAccount(String accountOwnerName, String accountOwnerSSN,int accountNumber, double initialBalance, int initialRate){}\n                           \n                           \n                           \n                           \n                           \n                           public void start(final double rate){}"}}, "#text": "public class BankAccount {}"}, "#text_blocks": ["public class BankAccount {", "// private member variables of BankAccount class", "private String accountOwnerName;", "private String accountOwnerSSN;", "private int accountNumber;", "private double balance;", "// constructor for BankAccount class", "public BankAccount(String accountOwnerName, String accountOwnerSSN,", "int accountNumber, double initialBalance, int initialRate)", "{", "this.accountOwnerName = accountOwnerName;", "this.accountOwnerSSN = accountOwnerSSN;", "this.accountNumber = accountNumber;", "this.balance = initialBalance;", "this.start(initialRate);", "}", "// start method will add interest to balance every 30 days", "// creates timer object and interest adding action listener object", "public void start(final double rate)", "{", "// InterestAdder is a local inner class", "// that implements the ActionListener interface", "class InterestAdder implements ActionListener", "{", "public void actionPerformed(ActionEvent event)", "{", "// update interest", "double interest = BankAccount.this.balance * rate / 100;", "BankAccount.this.balance += interest;", "}", "}", "ActionListener adder = new InterestAdder();", "Timer t = new Timer(1000 * 3600 * 24 * 30, adder);", "t.start();", "}", "}"]}, {"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:i": ["// private member variables of BankAccount class", "// constructor for BankAccount class", "// start method will add interest to balance every 30 days", "// creates timer object and interest adding action listener object"], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "#text": "this.accountOwnerName = accountOwnerName;this.accountOwnerSSN = accountOwnerSSN;this.accountNumber = accountNumber;this.balance = initialBalance;this.start(initialRate);"}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null], "xhtml:i": "// anonymous inner class that implements the ActionListener interface", "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null], "#text": "double interest = BankAccount.this.balance * rate / 100;\n                                             BankAccount.this.balance += interest;"}}, "#text": "public void actionPerformed(ActionEvent event){}"}}, "#text": "ActionListener adder = new ActionListener(){};\n                                 Timer t = new Timer(1000 * 3600 * 24 * 30, adder);t.start();"}}], "#text": "private String accountOwnerName;private String accountOwnerSSN;private int accountNumber;private double balance;\n                           \n                           \n                           public BankAccount(String accountOwnerName, String accountOwnerSSN,int accountNumber, double initialBalance, int initialRate){}\n                           \n                           \n                           \n                           \n                           \n                           public void start(final double rate){}"}}, "#text": "public class BankAccount {}"}, "#text_blocks": ["public class BankAccount {", "// private member variables of BankAccount class", "private String accountOwnerName;", "private String accountOwnerSSN;", "private int accountNumber;", "private double balance;", "// constructor for BankAccount class", "public BankAccount(String accountOwnerName, String accountOwnerSSN,", "int accountNumber, double initialBalance, int initialRate)", "{", "this.accountOwnerName = accountOwnerName;", "this.accountOwnerSSN = accountOwnerSSN;", "this.accountNumber = accountNumber;", "this.balance = initialBalance;", "this.start(initialRate);", "}", "// start method will add interest to balance every 30 days", "// creates timer object and interest adding action listener object", "public void start(final double rate)", "{", "// anonymous inner class that implements the ActionListener interface", "ActionListener adder = new ActionListener()", "{", "public void actionPerformed(ActionEvent event)", "{", "double interest = BankAccount.this.balance * rate / 100;", "BankAccount.this.balance += interest;", "}", "};", "Timer t = new Timer(1000 * 3600 * 24 * 30, adder);", "t.start();", "}", "}"]}]}, {"Intro_Text": "In the following Java example a simple applet provides the capability for a user to input a URL into a text field and have the URL opened in a new browser window. The applet contains an inner class that is an action listener for the submit button, when the user clicks the submit button the inner class action listener's actionPerformed method will open the URL entered into the text field in a new browser window. As with the previous examples using inner classes in this manner creates a security risk by exposing private variables and methods. Inner classes create an additional security risk with applets as applets are executed on a remote machine through a web browser within the same JVM and therefore may run side-by-side with other potentially malicious code.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:i": ["// private member variables for applet components", "// init method that adds components to applet", "// and creates button listener object", "// button listener inner class for UrlToolApplet class"], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null, null, null], "#text": "setLayout(new FlowLayout());enterUrlLabel = new Label(\"Enter URL: \");enterUrlTextField = new TextField(\"\", 20);submitButton = new Button(\"Submit\");add(enterUrlLabel);add(enterUrlTextField);add(submitButton);ActionListener submitButtonListener = new SubmitButtonListener();submitButton.addActionListener(submitButtonListener);"}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "url = new URL(urlString);"}, {"@style": "margin-left:1em;", "#text": "System.err.println(\"Malformed URL: \" + urlString);"}, {"@style": "margin-left:1em;", "#text": "getAppletContext().showDocument(url);"}], "#text": "String urlString = enterUrlTextField.getText();URL url = null;try {} catch (MalformedURLException e) {}if (url != null) {}"}, "#text": "if (evt.getSource() == submitButton) {}"}}, "#text": "public void actionPerformed(ActionEvent evt) {}"}}], "#text": "private Label enterUrlLabel;private TextField enterUrlTextField;private Button submitButton;\n                           \n                           \n                           \n                           \n                           \n                           public void init() {}\n                           \n                           \n                           private class SubmitButtonListener implements ActionListener {}"}}, "#text": "public class UrlToolApplet extends Applet {}"}, "#text_blocks": ["public class UrlToolApplet extends Applet {", "// private member variables for applet components", "private Label enterUrlLabel;", "private TextField enterUrlTextField;", "private Button submitButton;", "// init method that adds components to applet", "// and creates button listener object", "public void init() {", "setLayout(new FlowLayout());", "enterUrlLabel = new Label(\"Enter URL: \");", "enterUrlTextField = new TextField(\"\", 20);", "submitButton = new Button(\"Submit\");", "add(enterUrlLabel);", "add(enterUrlTextField);", "add(submitButton);", "ActionListener submitButtonListener = new SubmitButtonListener();", "submitButton.addActionListener(submitButtonListener);", "}", "// button listener inner class for UrlToolApplet class", "private class SubmitButtonListener implements ActionListener {", "public void actionPerformed(ActionEvent evt) {", "if (evt.getSource() == submitButton) {", "String urlString = enterUrlTextField.getText();", "URL url = null;", "try {", "url = new URL(urlString);", "} catch (MalformedURLException e) {", "System.err.println(\"Malformed URL: \" + urlString);", "}", "if (url != null) {", "getAppletContext().showDocument(url);", "}", "}", "}", "}", "}"]}, {"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null], "xhtml:i": ["// private member variables for applet components", "// init method that adds components to applet", "// implementation of actionPerformed method of ActionListener interface"], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null, null], "#text": "setLayout(new FlowLayout());enterUrlLabel = new Label(\"Enter URL: \");enterUrlTextField = new TextField(\"\", 20);submitButton = new Button(\"Submit\");add(enterUrlLabel);add(enterUrlTextField);add(submitButton);submitButton.addActionListener(this);"}, {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "url = new URL(urlString);"}, {"@style": "margin-left:1em;", "#text": "System.err.println(\"Malformed URL: \" + urlString);"}, {"@style": "margin-left:1em;", "#text": "getAppletContext().showDocument(url);"}], "#text": "String urlString = enterUrlTextField.getText();URL url = null;try {} catch (MalformedURLException e) {}if (url != null) {}"}, "#text": "if (evt.getSource() == submitButton) {}"}}], "#text": "private Label enterUrlLabel;private TextField enterUrlTextField;private Button submitButton;\n                           \n                           \n                           public void init() {}\n                           \n                           \n                           public void actionPerformed(ActionEvent evt) {}"}}, "#text": "public class UrlToolApplet extends Applet implements ActionListener {}"}, "#text_blocks": ["public class UrlToolApplet extends Applet implements ActionListener {", "// private member variables for applet components", "private Label enterUrlLabel;", "private TextField enterUrlTextField;", "private Button submitButton;", "// init method that adds components to applet", "public void init() {", "setLayout(new FlowLayout());", "enterUrlLabel = new Label(\"Enter URL: \");", "enterUrlTextField = new TextField(\"\", 20);", "submitButton = new Button(\"Submit\");", "add(enterUrlLabel);", "add(enterUrlTextField);", "add(submitButton);", "submitButton.addActionListener(this);", "}", "// implementation of actionPerformed method of ActionListener interface", "public void actionPerformed(ActionEvent evt) {", "if (evt.getSource() == submitButton) {", "String urlString = enterUrlTextField.getText();", "URL url = null;", "try {", "url = new URL(urlString);", "} catch (MalformedURLException e) {", "System.err.println(\"Malformed URL: \" + urlString);", "}", "if (url != null) {", "getAppletContext().showDocument(url);", "}", "}", "}", "}"]}], "Body_Text": "As with the previous examples a solution to this problem would be to use a static inner class, a local inner class or an anonymous inner class. An alternative solution would be to have the applet implement the action listener rather than using it as an inner class as shown in the following example."}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "7 Pernicious Kingdoms", "Entry_Name": "Mobile Code: Use of Inner Class"}, {"@Taxonomy_Name": "CLASP", "Entry_Name": "Publicizing of private data when using inner classes"}, {"@Taxonomy_Name": "The CERT Oracle Secure Coding Standard for Java (2011)", "Entry_ID": "OBJ08-J", "Entry_Name": "Do not expose private members of an outer class from within a nested class"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-6"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Notes": {"Note": {"@Type": "Other", "#text": "Mobile code, in this case a Java Applet, is code that is transmitted across a network and executed on a remote machine. Because mobile code developers have little if any control of the environment in which their code will execute, special security concerns become relevant. One of the biggest environmental threats results from the risk that the mobile code will run side-by-side with other, potentially malicious, mobile code. Because all of the popular web browsers execute code from multiple sources together in the same JVM, many of the security guidelines for mobile code are focused on preventing manipulation of your objects' state and behavior by adversaries who have access to the same virtual machine where your program is running."}}, "Content_History": {"Submission": {"Submission_Name": "7 Pernicious Kingdoms", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-03-10", "Modification_Version": "1.3", "Modification_ReleaseDate": "2009-03-10", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-12-28", "Modification_Version": "1.7", "Modification_ReleaseDate": "2009-12-28", "Modification_Comment": "updated Demonstrative_Examples, Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences, Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Description, Other_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Description, References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Detection_Factors, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated References"}], "Previous_Entry_Name": {"@Date": "2008-04-11", "#text": "Mobile Code: Use of Inner Class"}}, "entry_type": "Weakness"}