用户登录  |  用户注册
首 页商业源码原创产品编程论坛
当前位置:PB创新网文章中心Java

Java Security Notes (6)

减小字体 增大字体 作者:佚名  来源:本站整理  发布时间:2009-03-16 16:24:34
The five segments of notes take me three days to recall the basic knowledge of Java Security Mechanism--sandbox. But I like the language itself. Because I could control everything. Once your administrator set up environment for you, when you hope to get more authorization and right, you have to write e-mail, fill application form and ask your boss to approve it. What's troublesome nuts!

So I will start new topic--Java Languages Security. This is more interesting for me and more comfortable to express what I try to explain. But I don't discuss those exceptions such as native code that always trigger the problem as it's more like C/C++ code instead of Java code. As we all know, C/C++'s secuirty reply on yourself majorly.

Please remember these:public, protect, private, final . They are much better than C++. Because programmer haven't pointer to help them to snoop on hidden components in the class. Another good news is that Java forbid to arbitrarily cast class type unless there is some relationship between them such as derivative. Of course , you still can not stop memory snooper. What a pity!

The second bonus or maybe danger is object serialization. The file stored in hard disk. A lot of crazy guys could read it after trying with many times. How can we cope with it? One is to avoid from using it. The other is to encode them and override the writer and loader function.

The third tool is Javac , compiler tool. It can help to check security but weak functionality.

The forth trouble is from Java language itself. This problem is like Hook technique which have been used in network card capture application or API replacement. From the Java view, this is more easier than C++. Because there is one virtual machine used for application. Sun adds one bytecode verifier into virtual machine to detect corrupted code or illegal code. But Java uses special skill to do such detection--to verify bytecode only when the bytecode is performing. But it's not the runtime check. The real runtime check does not check class attribute but check array bounds and object casting.

As author said that the notion of security in Java is pervasive, its implementation is equally pervasive.


Tags:

作者:佚名

文章评论评论内容只代表网友观点,与本站立场无关!

   评论摘要(共 0 条,得分 0 分,平均 0 分) 查看完整评论
PB创新网ourmis.com】Copyright © 2000-2009 . All Rights Reserved .
页面执行时间:9,390.62500 毫秒
Email:ourmis@126.com QQ:2322888 蜀ICP备05006790号