CWE-579 J2EE不安全实践：将不可序列化的对象存储在会话中

J2EE Bad Practices: Non-serializable Object Stored in Session

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

The application stores a non-serializable object as an HttpSession attribute, which can hurt reliability.

扩展描述

A J2EE application can make use of multiple JVMs in order to improve application reliability and performance. In order to make the multiple JVMs appear as a single application to the end user, the J2EE container can replicate an HttpSession object across multiple JVMs so that if one JVM becomes unavailable another can step in and take its place without disrupting the flow of the application. This is only possible if all session data is serializable, allowing the session to be duplicated between the JVMs.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 573 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 573 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Name': 'Java', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Other Quality Degradation

可能的缓解方案

Implementation

策略:

In order for session replication to work, the values the application stores as attributes in the session must implement the Serializable interface.

示例代码

例

The following class adds itself to the session, but because it is not serializable, the session can no longer be replicated.

bad Java

public class DataGlob {
String globName;
String globValue;

public void addToSession(HttpSession session) {
session.setAttribute("glob", this);
}
}

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
Software Fault Patterns SFP1 Glitch in computation