|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
CWE-577: EJB Bad Practices: Use of Sockets
 DescriptionDescription Summary The program violates the Enterprise JavaBeans (EJB) specification by using sockets.
Extended Description The Enterprise JavaBeans specification requires that every bean provider follow a set of programming guidelines designed to ensure that the bean will be portable and behave consistently in any EJB container. In this case, the program violates the following EJB guideline: "An enterprise bean must not attempt to listen on a socket, accept connections on a socket, or use a socket for multicast." The specification justifies this requirement in the following way: "The EJB architecture allows an enterprise bean instance to be a network socket client, but it does not allow it to be a network server. Allowing the instance to become a network server would conflict with the basic function of the enterprise bean-- to serve the EJB clients." Time of Introduction
Applicable PlatformsLanguages Java Common Consequences
Demonstrative ExamplesExample 1 The following Java example is a simple stateless Enterprise JavaBean that retrieves stock symbols and stock values. The Enterprise JavaBean creates a socket and listens for and accepts connections from clients on the socket. (Bad Code) Example
Language: Java @Stateless public class StockSymbolBean implements StockSymbolRemote { ServerSocket serverSocket = null;
Socket clientSocket = null;
public StockSymbolBean() {
try {
serverSocket = new
ServerSocket(Constants.SOCKET_PORT);
} catch (IOException ex) {...}
try {
clientSocket = serverSocket.accept();
} catch (IOException e) {...}
}
public String getStockSymbol(String name) {...}
public BigDecimal getStockValue(String symbol) {...}
private void processClientInputFromSocket() {...}
} And the following Java example is similar to the previous example but demonstrates the use of multicast socket connections within an Enterprise JavaBean. (Bad Code) Example
Language: Java @Stateless public class StockSymbolBean extends Thread implements
StockSymbolRemote { ServerSocket serverSocket = null;
Socket clientSocket = null;
boolean listening = false;
public StockSymbolBean() {
try {
serverSocket = new
ServerSocket(Constants.SOCKET_PORT);
} catch (IOException ex) {...}
listening = true;
while(listening) {
start();
}
}
public String getStockSymbol(String name) {...}
public BigDecimal getStockValue(String symbol) {...}
public void run() {
try {
clientSocket = serverSocket.accept();
} catch (IOException e) {...}
...
}
} The previous two examples within any type of Enterprise JavaBean violate the EJB specification by attempting to listen on a socket, accepting connections on a socket, or using a socket for multicast. Potential Mitigations
Relationships
Content History
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Page Last Updated:
September 12, 2011
|
|
CWE is a Software Assurance strategic initiative co-sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is sponsored and managed by The MITRE Corporation to enable stakeholder collaboration. Copyright © 2006-2012, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information. |
|
|