Enforcing Secure Object Initialization in Java

Laurent Hubert 1, * Thomas Jensen 1 Vincent Monfort 1 David Pichardie 1
* Auteur correspondant
1 CELTIQUE - Software certification with semantic analysis
Inria Rennes – Bretagne Atlantique , IRISA-D4 - LANGAGE ET GÉNIE LOGICIEL
Abstract : Sun and the CERT recommend for secure Java development to not allow partially initialized objects to be accessed. The CERT considers the severity of the risks taken by not following this recommendation as high. The solution currently used to enforce object initialization is to implement a coding pattern proposed by Sun, which is not formally checked. We propose a modular type system to formally specify the initialization policy of libraries or programs and a type checker to statically check at load time that all loaded classes respect the policy. This allows to prove the absence of bugs which have allowed some famous privilege escalations in Java. Our experimental results show that our safe default policy allows to prove 91% of classes of java.lang, java.security and javax.security safe without any annotation and by adding 57 simple annotations we proved all classes but four safe. The type system and its soundness theorem have been formalized and machine checked using Coq.
Type de document :
Communication dans un congrès
15th European Symposium on Research in Computer Security (ESORICS), 2010, Athènes, Greece. Springer-Verlag, 6345, pp.101-115, 2010, Lecture Notes in Computer Science
Liste complète des métadonnées

Littérature citée [10 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/inria-00503953
Contributeur : David Pichardie <>
Soumis le : lundi 19 juillet 2010 - 14:11:05
Dernière modification le : mercredi 16 mai 2018 - 11:23:28
Document(s) archivé(s) le : vendredi 22 octobre 2010 - 16:09:27

Fichiers

esorics.pdf
Fichiers produits par l'(les) auteur(s)

Identifiants

  • HAL Id : inria-00503953, version 1
  • ARXIV : 1007.3133

Citation

Laurent Hubert, Thomas Jensen, Vincent Monfort, David Pichardie. Enforcing Secure Object Initialization in Java. 15th European Symposium on Research in Computer Security (ESORICS), 2010, Athènes, Greece. Springer-Verlag, 6345, pp.101-115, 2010, Lecture Notes in Computer Science. 〈inria-00503953〉

Partager

Métriques

Consultations de la notice

717

Téléchargements de fichiers

151