Developer's Guide to Web Application Security

■

Java code guidelines

■

C code guidelines

Privileged Code Guidelines

In this chapter, we learned how to create security managers that restrict code from

doing certain operations. Unfortunately, these restrictions will apply to all the code

running in the JVM. Sometimes, you would like to restrict all the code, except for

maybe a small block of code that must perform some basic function. Java has actually

included the ability to allow privileged code to execute outside of the security man-

ager. Basically, Sun has three recommendations when using privileged code. All priv-

ileged code blocks should be as short as possible. If your privileged code is v ...