Identificar Clases y Métodos Inseguros

Necesidad

Identificar métodos o clases inseguras en Java.

Contexto

A continuación se describen las circunstancias bajo las cuales la siguiente solución tiene sentido:

  1. Se está desarrollando una aplicación en Java.

  2. Se desea evitar el uso de funciones inseguras del lenguaje.

Solución

Cuando se habla de las clases y métodos obsoletos, por lo general, se refiere a las clases y/o métodos que ya no son considerados eficientes o seguros y por tanto, pronto serán eliminados por el desarrollador o fabricante del mismo. Las razones más comunes por las cuales se determina que una clase o método inseguro y/o obsoleto son las siguientes:

  1. La clase o método ha sido sustituida por una alternativa más potente que puede proveer más seguridad y soporte corrigiendo así posibles fallos o vulnerabilidades previamente reportados.

  2. El código contiene uno o varios defectos de diseño que pueden poner en riesgo la seguridad y correcto funcionamiento de las aplicaciones que los usan.

  3. La clase o método es considerado demasiado complejo para su implementación, y por tanto se desea eliminar por una alternativa más simple que realice las mismas funciones.

  4. El desarrollo y puesta en marcha de nuevas versiones del software, haciendo que el uso de características viejas contenidas en el código puedan presentar problemas de compatibilidad o crear posibles problemas de seguridad e implementación.

  5. Cuando se realiza una estandarización de las clases o métodos con el fin de reglamentar la manera en que se deben implementar los mismos.

  6. Cuando se unifican dos o más clases o métodos. Es decir, cuando dos clases o métodos tienen funcionalidades similares o se complementan mutuamente, se suele unirlas con el fin de simplicar su uso y mantenibilidad.

  7. Hay que tener en cuenta que el uso de métodos o clases obsoletas representa un riesgo para la seguridad puesto que, como ya se ha explicado, presentan múltiples errores y, además, es considerado como una de las practicas inadecuadas de programación.

  8. Las siguientes interfaces son consideradas obsoletas.

    interfaces.java
    org.xml.sax.AttributeList
java.security.Certificate
org.xml.sax.DocumentHandler
org.omg.CORBA.DynAny
org.omg.CORBA.DynArray
org.omg.CORBA.DynEnum
org.omg.CORBA.DynFixed
org.omg.CORBA.DynSequence
org.omg.CORBA.DynStruct
org.omg.CORBA.DynUnion
org.omg.CORBA.DynValue
java.rmi.server.LoaderHandler
org.xml.sax.Parser
java.rmi.registry.RegistryHandler
java.rmi.server.RemoteCall
java.rmi.server.Skeleton

  9. Las siguientes clases son obsoletas

    clases.java
    javax.accessibility.AccessibleResourceBundle
org.xml.sax.helpers.AttributeListImpl
javax.management.DefaultLoaderRepository
javax.management.loading.DefaultLoaderRepository
javax.swing.text.DefaultTextUI
org.omg.CORBA.DynamicImplementation
java.security.Identity
java.security.IdentityScope
java.io.LineNumberInputStream
java.rmi.server.LogStream
javax.swing.plaf.metal.MetalComboBoxUI.MetalComboPopup
java.rmi.server.Operation
org.xml.sax.helpers.ParserFactory
javax.security.auth.Policy
org.omg.CORBA.Principal
org.omg.CORBA.PrincipalHolder
java.security.Signer
java.io.StringBufferInputStream
javax.swing.text.TableView.TableCell
javax.management.timer.TimerAlarmClockNotification

  10. Estas son excepciones obsoletas.

    excepcion.java
    java.rmi.RMISecurityException
java.rmi.ServerRuntimeException
java.rmi.server.SkeletonMismatchException
java.rmi.server.SkeletonNotFoundException
Deprecated Fields

  11. El uso de estos campos o elementos es obsoleto.

    campos.java
    javax.management.monitor.Monitor.alreadyNotified
javax.swing.JViewport.backingStore
javax.swing.plaf.basic.BasicDesktopPaneUI.closeKey
java.awt.Frame.CROSSHAIR_CURSOR
javax.management.monitor.Monitor.dbgTag
java.awt.Frame.DEFAULT_CURSOR
javax.swing.JRootPane.defaultPressAction
javax.swing.JRootPane.defaultReleaseAction
javax.swing.plaf.basic.BasicSplitPaneUI.dividerResizeToggleKey
javax.swing.plaf.basic.BasicToolBarUI.downKey
javax.swing.plaf.basic.BasicTabbedPaneUI.downKey
javax.swing.plaf.basic.BasicSplitPaneUI.downKey
java.awt.Frame.E_RESIZE_CURSOR
javax.swing.plaf.basic.BasicSplitPaneUI.endKey
java.awt.Frame.HAND_CURSOR
javax.swing.plaf.basic.BasicSplitPaneUI.homeKey
java.net.HttpURLConnection.HTTP_SERVER_ERROR
java.lang.SecurityManager.inCheck
javax.swing.plaf.basic.BasicSplitPaneUI.keyboardDownRightListener
javax.swing.plaf.basic.BasicSplitPaneUI.keyboardEndListener
javax.swing.plaf.basic.BasicSplitPaneUI.keyboardHomeListener
javax.swing.plaf.basic.BasicSplitPaneUI.keyboardResizeToggleListener
javax.swing.plaf.basic.BasicSplitPaneUI.keyboardUpLeftListener
javax.swing.plaf.basic.BasicToolBarUI.leftKey
javax.swing.plaf.basic.BasicTabbedPaneUI.leftKey
javax.swing.plaf.basic.BasicSplitPaneUI.leftKey
javax.swing.plaf.basic.BasicDesktopPaneUI.maximizeKey
javax.swing.plaf.basic.BasicDesktopPaneUI.minimizeKey
java.awt.Frame.MOVE_CURSOR
java.awt.Frame.N_RESIZE_CURSOR
javax.swing.plaf.basic.BasicDesktopPaneUI.navigateKey
javax.swing.plaf.basic.BasicDesktopPaneUI.navigateKey2
java.awt.Frame.NE_RESIZE_CURSOR
java.awt.Frame.NW_RESIZE_CURSOR
javax.swing.plaf.basic.BasicInternalFrameUI.openMenuKey
java.awt.datatransfer.DataFlavor.plainTextFlavor
javax.swing.text.html.FormView.RESET
javax.swing.table.TableColumn.resizedPostingDisableCount
javax.swing.plaf.basic.BasicToolBarUI.rightKey
javax.swing.plaf.basic.BasicTabbedPaneUI.rightKey
javax.swing.plaf.basic.BasicSplitPaneUI.rightKey
java.awt.Frame.S_RESIZE_CURSOR
java.awt.Frame.SE_RESIZE_CURSOR
javax.swing.text.html.FormView.SUBMIT
java.lang.Character.UnicodeBlock.SURROGATES_AREA
java.awt.Frame.SW_RESIZE_CURSOR
java.awt.Frame.TEXT_CURSOR
javax.swing.plaf.basic.BasicToolBarUI.upKey
javax.swing.plaf.basic.BasicTabbedPaneUI.upKey
javax.swing.plaf.basic.BasicSplitPaneUI.upKey
java.awt.Frame.W_RESIZE_CURSOR
java.awt.Frame.WAIT_CURSOR

  12. Los siguientes métodos son obsoletos.

    metodos.java
    java.awt.Component.action(Event, Object)
java.awt.List.addItem(String)
java.awt.List.addItem(String, int)
java.awt.CardLayout.addLayoutComponent(String, Component)
java.awt.BorderLayout.addLayoutComponent(String, Component)
java.awt.List.allowsMultipleSelections()
java.lang.ThreadGroup.allowThreadSuspension(boolean)
java.awt.TextArea.appendText(String)
java.awt.Window.applyResourceBundle(ResourceBundle)
java.awt.Window.applyResourceBundle(String)
java.awt.Component.bounds()
java.lang.SecurityManager.checkMulticast(InetAddress, byte)
java.lang.SecurityManager.classDepth(String)
java.lang.SecurityManager.classLoaderDepth()
java.awt.List.clear()
java.awt.image.renderable.RenderContext.concetenateTransform(AffineTransform)
java.awt.Container.countComponents()
java.awt.Choice.countItems()
java.awt.List.countItems()
java.awt.Menu.countItems()
java.awt.MenuBar.countMenus()
java.lang.Thread.countStackFrames()
org.omg.CORBA.ORB.create_basic_dyn_any(TypeCode)
org.omg.CORBA.ORB.create_dyn_any(Any)
org.omg.CORBA.ORB.create_dyn_array(TypeCode)
org.omg.CORBA.ORB.create_dyn_enum(TypeCode)
org.omg.CORBA.ORB.create_dyn_sequence(TypeCode)
org.omg.CORBA.ORB.create_dyn_struct(TypeCode)
org.omg.CORBA.ORB.create_dyn_union(TypeCode)
org.omg.CORBA.ORB.create_recursive_sequence_tc(int, int)
javax.swing.plaf.basic.BasicSplitPaneUI.createKeyboardDownRightListener()
javax.swing.plaf.basic.BasicSplitPaneUI.createKeyboardEndListener()
javax.swing.plaf.basic.BasicSplitPaneUI.createKeyboardHomeListener()
javax.swing.plaf.basic.BasicSplitPaneUI.createKeyboardResizeToggleListener()
javax.swing.plaf.basic.BasicSplitPaneUI.createKeyboardUpLeftListener()
javax.swing.JTable.createScrollPaneForTable(JTable)
javax.swing.text.TableView.createTableCell(Element)
java.lang.SecurityManager.currentClassLoader()
java.lang.SecurityManager.currentLoadedClass()
java.net.URLDecoder.decode(String)
java.lang.ClassLoader.defineClass(byte[], int, int)
java.awt.List.delItem(int)
java.awt.List.delItems(int, int)
java.awt.Component.deliverEvent(Event)
java.awt.Container.deliverEvent(Event)
javax.management.MBeanServer.deserialize(ObjectName, byte[])
javax.management.MBeanServer.deserialize(String, byte[])
javax.management.MBeanServer.deserialize(String, ObjectName, byte[])
java.lang.Thread.destroy()
java.awt.MenuItem.disable()
java.awt.Component.disable()
javax.swing.JComponent.disable()
javax.swing.table.TableColumn.disableResizedPosting()
javax.swing.FocusManager.disableSwingFocusManager()
java.rmi.server.Skeleton.dispatch(Remote, RemoteCall, int, long)
java.rmi.server.RemoteCall.done()
java.rmi.server.RemoteRef.done(RemoteCall)
javax.swing.plaf.metal.MetalComboBoxUI.editablePropertyChanged(PropertyChangeEvent)
java.awt.MenuItem.enable()
java.awt.Component.enable()
javax.swing.JComponent.enable()
java.awt.MenuItem.enable(boolean)
java.awt.Component.enable(boolean)
javax.swing.table.TableColumn.enableResizedPosting()
java.net.URLEncoder.encode(String)
java.security.SignatureSpi.engineGetParameter(String)
java.security.SignatureSpi.engineSetParameter(String, Object)
java.awt.datatransfer.DataFlavor.equals(String)
org.omg.CORBA.ServerRequest.except(Any)
java.rmi.server.RemoteCall.executeCall()
org.omg.CORBA.Any.extract_Principal()
javax.swing.SwingUtilities.findFocusOwner(Component)
org.omg.CORBA.ORB.get_current()
java.security.Security.getAlgorithmProperty(String, String)
java.sql.CallableStatement.getBigDecimal(int, int)
java.sql.ResultSet.getBigDecimal(int, int)
java.sql.ResultSet.getBigDecimal(String, int)
java.awt.Polygon.getBoundingBox()
java.lang.String.getBytes(int, int, byte[], int)
java.awt.Graphics.getClipRect()
javax.swing.JPopupMenu.getComponentAtIndex(int)
javax.swing.JMenuBar.getComponentAtIndex(int)
java.awt.CheckboxGroup.getCurrent()
java.awt.Frame.getCursorType()
java.sql.Time.getDate()
java.util.Date.getDate()
java.sql.Time.getDay()
java.util.Date.getDay()
java.net.URLConnection.getDefaultRequestProperty(String)
java.rmi.server.LogStream.getDefaultStream()
javax.management.monitor.StringMonitorMBean.getDerivedGauge()
javax.management.monitor.StringMonitor.getDerivedGauge()
javax.management.monitor.CounterMonitorMBean.getDerivedGauge()
javax.management.monitor.CounterMonitor.getDerivedGauge()
javax.management.monitor.GaugeMonitorMBean.getDerivedGauge()
javax.management.monitor.GaugeMonitor.getDerivedGauge()
javax.management.monitor.StringMonitorMBean.getDerivedGaugeTimeStamp()
javax.management.monitor.StringMonitor.getDerivedGaugeTimeStamp()
javax.management.monitor.CounterMonitorMBean.getDerivedGaugeTimeStamp()
javax.management.monitor.CounterMonitor.getDerivedGaugeTimeStamp()
javax.management.monitor.GaugeMonitorMBean.getDerivedGaugeTimeStamp()
javax.management.monitor.GaugeMonitor.getDerivedGaugeTimeStamp()
javax.swing.plaf.basic.BasicSplitPaneUI.getDividerBorderSize()
java.awt.Toolkit.getFontList()
javax.swing.text.LabelView.getFontMetrics()
java.awt.Toolkit.getFontMetrics(Font)
java.awt.Toolkit.getFontPeer(String, int)
java.sql.Date.getHours()
java.util.Date.getHours()
java.lang.SecurityManager.getInCheck()
java.rmi.server.RemoteCall.getInputStream()
javax.swing.KeyStroke.getKeyStroke(char, boolean)
javax.swing.AbstractButton.getLabel()
java.awt.Scrollbar.getLineIncrement()
java.lang.Runtime.getLocalizedInputStream(InputStream)
java.lang.Runtime.getLocalizedOutputStream(OutputStream)
java.sql.DriverManager.getLogStream()
java.awt.FontMetrics.getMaxDecent()
javax.swing.JInternalFrame.getMenuBar()
javax.swing.JRootPane.getMenuBar()
java.sql.Date.getMinutes()
java.util.Date.getMinutes()
java.sql.Time.getMonth()
java.util.Date.getMonth()
javax.swing.JComponent.getNextFocusableComponent()
javax.management.monitor.MonitorMBean.getObservedObject()
javax.management.monitor.Monitor.getObservedObject()
java.rmi.server.Operation.getOperation()
java.rmi.server.Skeleton.getOperations()
java.awt.ComponentOrientation.getOrientation(ResourceBundle)
java.rmi.server.LogStream.getOutputStream()
java.rmi.server.RemoteCall.getOutputStream()
java.awt.Scrollbar.getPageIncrement()
java.security.Signature.getParameter(String)
java.awt.MenuComponent.getPeer()
java.awt.Font.getPeer()
java.awt.Component.getPeer()
java.rmi.server.RemoteCall.getResultStream(boolean)
java.sql.Date.getSeconds()
java.util.Date.getSeconds()
java.rmi.server.LoaderHandler.getSecurityContext(ClassLoader)
java.rmi.server.RMIClassLoader.getSecurityContext(ClassLoader)
javax.swing.JPasswordField.getText()
javax.swing.JPasswordField.getText(int, int)
javax.management.monitor.CounterMonitorMBean.getThreshold()
javax.management.monitor.CounterMonitor.getThreshold()
java.util.Date.getTimezoneOffset()
java.net.MulticastSocket.getTTL()
java.net.DatagramSocketImpl.getTTL()
java.sql.ResultSet.getUnicodeStream(int)
java.sql.ResultSet.getUnicodeStream(String)
javax.swing.ScrollPaneLayout.getViewportBorderBounds(JScrollPane)
java.awt.Scrollbar.getVisible()
java.sql.Time.getYear()
java.util.Date.getYear()
java.awt.Component.gotFocus(Event, Object)
java.awt.Component.handleEvent(Event)
java.awt.Dialog.hide()
java.awt.Component.hide()
java.awt.Window.hide()
java.lang.SecurityManager.inClass(String)
java.lang.SecurityManager.inClassLoader()
org.omg.CORBA.Any.insert_Principal(Principal)
javax.swing.text.html.HTMLEditorKit.InsertHTMLTextAction.insertAtBoundry
(JEditorPane, HTMLDocument, int, Element, String, HTML.Tag, HTML.Tag)
java.awt.TextArea.insertText(String, int)
java.awt.Container.insets()
java.awt.Polygon.inside(int, int)
java.awt.Rectangle.inside(int, int)
java.awt.Component.inside(int, int)
java.rmi.server.RemoteRef.invoke(RemoteCall)
org.omg.CORBA.DynamicImplementation.invoke(ServerRequest)
javax.swing.JViewport.isBackingStoreEnabled()
javax.swing.FocusManager.isFocusManagerEnabled()
java.awt.Component.isFocusTraversable()
java.lang.Character.isJavaLetter(char)
java.lang.Character.isJavaLetterOrDigit(char)
javax.swing.JComponent.isManagingFocus()
java.awt.List.isSelected(int)
java.lang.Character.isSpace(char)
java.rmi.dgc.VMID.isUnique()
java.awt.Component.keyDown(Event, int)
java.awt.Component.keyUp(Event, int)
java.awt.ScrollPane.layout()
java.awt.Component.layout()
java.awt.Container.layout()
java.rmi.server.LoaderHandler.loadClass(String)
java.rmi.server.RMIClassLoader.loadClass(String)
java.rmi.server.LoaderHandler.loadClass(URL, String)
java.awt.Component.locate(int, int)
java.awt.Container.locate(int, int)
java.awt.Component.location()
java.rmi.server.LogStream.log(String)
java.awt.Component.lostFocus(Event, Object)
java.awt.TextArea.minimumSize()
java.awt.List.minimumSize()
java.awt.TextField.minimumSize()
java.awt.Component.minimumSize()
java.awt.Container.minimumSize()
java.awt.List.minimumSize(int)
java.awt.TextField.minimumSize(int)
java.awt.TextArea.minimumSize(int, int)
javax.swing.text.View.modelToView(int, Shape)
java.awt.Component.mouseDown(Event, int, int)
java.awt.Component.mouseDrag(Event, int, int)
java.awt.Component.mouseEnter(Event, int, int)
java.awt.Component.mouseExit(Event, int, int)
java.awt.Component.mouseMove(Event, int, int)
java.awt.Component.mouseUp(Event, int, int)
java.awt.Rectangle.move(int, int)
java.awt.Component.move(int, int)
org.omg.CORBA.Principal.name()
org.omg.CORBA.Principal.name(byte[])
java.rmi.server.RemoteRef.newCall(RemoteObject, Operation[], int, long)
java.awt.Component.nextFocus()
java.awt.datatransfer.DataFlavor.normalizeMimeType(String)
java.awt.datatransfer.DataFlavor.normalizeMimeTypeParameter(String, String)
org.omg.CORBA.ServerRequest.op_name()
org.omg.CORBA.ServerRequest.params(NVList)
java.util.Date.parse(String)
java.rmi.server.LogStream.parseLevel(String)
java.awt.MenuComponent.postEvent(Event)
java.awt.MenuContainer.postEvent(Event)
java.awt.Component.postEvent(Event)
java.awt.Window.postEvent(Event)
java.awt.image.renderable.RenderContext.preConcetenateTransform(AffineTransform)
java.awt.TextArea.preferredSize()
java.awt.List.preferredSize()
java.awt.TextField.preferredSize()
java.awt.Component.preferredSize()
java.awt.Container.preferredSize()
java.awt.List.preferredSize(int)
java.awt.TextField.preferredSize(int)
java.awt.TextArea.preferredSize(int, int)
org.omg.CORBA.portable.InputStream.read_Principal()
java.io.DataInputStream.readLine()
java.io.ObjectInputStream.readLine()
java.rmi.registry.RegistryHandler.registryImpl(int)
java.rmi.registry.RegistryHandler.registryStub(String, int)
java.rmi.server.RemoteCall.releaseInputStream()
java.rmi.server.RemoteCall.releaseOutputStream()
javax.swing.plaf.metal.MetalComboBoxUI.removeListeners()
java.awt.TextArea.replaceText(String, int, int)
javax.swing.JComponent.requestDefaultFocus()
java.awt.Rectangle.reshape(int, int, int, int)
java.awt.Component.reshape(int, int, int, int)
javax.swing.JComponent.reshape(int, int, int, int)
java.awt.Component.resize(Dimension)
java.awt.Rectangle.resize(int, int)
java.awt.Component.resize(int, int)
org.omg.CORBA.ServerRequest.result(Any)
java.lang.Thread.resume()
java.lang.ThreadGroup.resume()
java.lang.System.runFinalizersOnExit(boolean)
java.lang.Runtime.runFinalizersOnExit(boolean)
java.util.Properties.save(OutputStream, String)
java.net.MulticastSocket.send(DatagramPacket, byte)
javax.swing.JViewport.setBackingStoreEnabled(boolean)
java.awt.CheckboxGroup.setCurrent(Checkbox)
java.awt.Frame.setCursor(int)
java.sql.Time.setDate(int)
java.util.Date.setDate(int)
java.net.URLConnection.setDefaultRequestProperty(String, String)
java.rmi.server.LogStream.setDefaultStream(PrintStream)
java.awt.TextField.setEchoCharacter(char)
java.sql.Date.setHours(int)
java.util.Date.setHours(int)
javax.swing.AbstractButton.setLabel(String)
java.awt.Scrollbar.setLineIncrement(int)
java.sql.DriverManager.setLogStream(PrintStream)
javax.management.ValueExp.setMBeanServer(MBeanServer)
javax.swing.JInternalFrame.setMenuBar(JMenuBar)
javax.swing.JRootPane.setMenuBar(JMenuBar)
java.sql.Date.setMinutes(int)
java.util.Date.setMinutes(int)
java.awt.event.KeyEvent.setModifiers(int)
java.sql.Time.setMonth(int)
java.util.Date.setMonth(int)
java.awt.List.setMultipleSelections(boolean)
javax.swing.JComponent.setNextFocusableComponent(Component)
javax.management.monitor.MonitorMBean.setObservedObject(ObjectName)
javax.management.monitor.Monitor.setObservedObject(ObjectName)
java.rmi.server.LogStream.setOutputStream(OutputStream)
java.awt.Scrollbar.setPageIncrement(int)
java.security.Signature.setParameter(String, Object)
java.rmi.server.RemoteStub.setRef(RemoteStub, RemoteRef)
java.sql.Date.setSeconds(int)
java.util.Date.setSeconds(int)
javax.management.monitor.CounterMonitorMBean.setThreshold(Number)
javax.management.monitor.CounterMonitor.setThreshold(Number)
java.net.MulticastSocket.setTTL(byte)
java.net.DatagramSocketImpl.setTTL(byte)
java.sql.PreparedStatement.setUnicodeStream(int, InputStream, int)
javax.sql.rowset.BaseRowSet.setUnicodeStream(int, InputStream, int)
java.net.URLStreamHandler.setURL(URL, String, String, int, String, String)
java.sql.Time.setYear(int)
java.util.Date.setYear(int)
java.awt.Dialog.show()
java.awt.Component.show()
java.awt.Window.show()
java.awt.Component.show(boolean)
java.awt.Component.size()
javax.swing.JTable.sizeColumnsToFit(boolean)
java.lang.Thread.stop()
java.lang.ThreadGroup.stop()
java.lang.Thread.stop(Throwable)
java.lang.Thread.suspend()
java.lang.ThreadGroup.suspend()
java.util.Date.toGMTString()
java.util.Date.toLocaleString()
java.rmi.server.LogStream.toString()
java.rmi.server.Operation.toString()
java.io.ByteArrayOutputStream.toString(int)
java.util.Date.UTC(int, int, int, int, int, int)
javax.swing.text.View.viewToModel(float, float, Shape)
org.omg.CORBA.portable.OutputStream.write_Principal(Principal)
java.rmi.server.LogStream.write(byte[], int, int)
java.rmi.server.LogStream.write(int)
java.io.ObjectOutputStream.PutField.write(ObjectOutput)

Referencias

  1. How and When To Deprecate APIs

  2. Why Developers Should Not Write Programs That Call 'sun' Packages

  3. REQ.158 Codificación Actualizada

OWASP logo

Corporate member of The OWASP Foundation

Clutch Review
Service status - Terms of Use - Privacy Policy - Cookie Policy

Copyright © 2021 Fluid Attacks, We hack your software. All rights reserved.