Chapter 17. Runtime Environment (ENV)
Rules
Risk Assessment Summary
ENV00-J. Do not sign code that performs only unprivileged operations
Java uses code signing as a requirement for granting elevated privileges to code. Many security policies permit signed code to operate with elevated privileges. For example, Java applets can escape the default sandbox restrictions when signed. Consequently, users can grant explicit permissions either to a particular code base or to all code signed by a particular signer. This approach places control of security ...
Get The CERT® Oracle® Secure Coding Standard for Java™ now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
