Advanced Topics in Java and on Security in Systems Effective Generics. Eirik Eltvik 26 th of February 2007

Transcription

1 Advanced Topics in Java and on Security in Systems Effective Generics Eirik Eltvik 26 th of February 2007

2 Taking care when calling Legacy code Checks at compile-time is not always appropriate When? Legacy clients (paramatrized type) Untrusted clients (for security reasons) Information about types at run time

3 Legacy client class LegacyLibrary{ public static void additems(list list){ List.add(new Integer(1)); List.add( two ); public static List getitems(){ List list = new ArrayList(); List.add(new Integer(3)); List.add( four ); return list;

4 Naive client class naiveclient { public static void processitems(){ List<Integer> list = new ArrayList<Integer>(); LegacyLibrary.addItems(list); // ok List<Integer> list2 = LegacyLibrary.getItems(); //unchecked // later int s = 0; for (int i : list) s += i; // class cast exception for (int i: list2) s += i; // class cast exception

5 Warry Client class WarryClient{ public static void processitems(){ List<Integer> list = ArrayList<Integer>; List<Integer> view = Collections.checkedList(list,Integer.class); LegacyLibrary.addItems(view); // class cast exception List<Integer> list2 = LegacyLibrary.getItems(); // unchecked for (int i : list 2) { // class cast exception // sometime later The checklist method ensures, by using reflection, that the added element belongs to the specified class. However, since getitems adds it own list, can not use the wrapper. Solution: use an empty loop techique.

6 Insecure clients class NaiveBroker{ public void connect(ordersupplier supplier, OrderProcesser processes){ List<AutenticatedOrders> orders = new ArrayList<AutenticatedOrder>(); Supplier.addOrders(orders); Processer.processOrders(orders); class DeviousSupplier implements OrderSupplier{ public void addorders(list<autenticatedorder> orders){ List raw = orders; Order order = new Order(); // not autenticated raw.add(order); // unchecked!

7 How to prevent this scenario? Use a checked list, described in previous example. class WarryBroker{ public void connect(ordersupplier supplier, OrderProcesser processes){ List<AutenticatedOrders> orders = new ArrayList<AutenticatedOrder>(); Supplier.addOrders(Collection.checkedList(orders,AutenticatedOrder. class)); Processer.processOrders(orders); Note: If the supplier returns a list, then we can use the empty loop technique, described in last example.

8 Specialized classes Problem: Paramaterized types are not refiable, so we cannot use instance tests, casting and array creations. Solution: Create specialized classes. Two methods: 1. Using delegations (wrappers) 2. Inherticance (subclassing)

9 Specialized classes: Delegation We create a specialized class, ListStrings, which its wrap method returns a list of string The wrap method takes arguments as List<String> and returns ListString. It only takes Lists as Strings, because it implements ListString (which extends List<String>) If a non-string is inserted in the list, by using the wrap-method, a class exception is raised.

10 Specialized classes: Delegation This class support both random (ArrayList) and sequential access (LinkedList). If a list support fast random access it implements RandomAccess To define random and sequential access list, we use AbstractList and AbstractSequientalList

11 Specialized classes: Inherticance We create a specialization of ArrayList<String>. Only the constructors needs to be defined (since all methods are inherted from ArrayList).

12 Specialized classes: Delegation vs. Specialization Deligation, creates a view. Specialization, creates a new list. 1. By using views, elements put into the view, also appear in the original List 2. Adding a non-string to the view (delegated), throws a ClassCastException. Specialization does not. Delegation is best, security-wise.

13 Maintain Binary Compatibility Binary compatibility is guaranteed if the erasure of the signature of the generic code is identical to the signature of the legacy code AND if both versions compile to the same bytecode. [ ]

14 Maintain Binary Compatibility: Adjusting the erasure example 1/2 Legacy version public static Object max(collection coll) Generic version public static <T extends Comparable<? Super T>> T max(collection<? Extends T> coll) Problem: Signature has the wrong erasure. It returns comparable,not Object!

15 Maintain Binary Compatibility: Adjusting the erasure example 2/2 public static <T extends Object & Comparable<? Super T>> T max(collection<? Extends T> coll) When there are multiple bounds, the leftmost bound is taken for the erasure, so it returns Object.

16 Maintain Binary Compatibility Bridges public class Integer implements Comparable{ public int compareto(object O){ public int compareto(integer i){ public final class Integer implements Comparable<Integer> { public int compareto(integer i){ No problem, since the compiler generates a bridge method for compareto with an argument of Object.

17 Maintain Binary Compatibility: Using bridges example 1/2 Problem: The legacy method only takes Object as parameter: public interface Name extends Comparable{ public int compareto(object o); public interface Name extends Comparable<Name>{ public int compareto(name n);

18 Maintain Binary Compatibility: Using bridges example 2/2 public interface Name extends Comparable<Object>{ public int compareto(object o); Solution: Create a less-ambitious generification (Object instead of Name) If not, this would issue an error on run time because legacy class does not implement compareto(name)