|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
CWE-594: J2EE Framework: Saving Unserializable Objects to Disk
 DescriptionDescription Summary When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.
Time of Introduction
Applicable PlatformsLanguages Java Common Consequences
Demonstrative ExamplesExample 1 In the following Java example, a Customer Entity JavaBean provides access to customer information in a database for a business application. The Customer Entity JavaBean is used as a session scoped object to return customer information to a Session EJB. (Bad Code) Example
Language: Java @Entity public class Customer { private String id;
private String firstName;
private String lastName;
private Address address;
public Customer() {
}
public Customer(String id, String firstName, String lastName)
{...}
@Id
public String getCustomerId() {...}
public void setCustomerId(String id) {...}
public String getFirstName() {...}
public void setFirstName(String firstName) {...}
public String getLastName() {...}
public void setLastName(String lastName) {...}
@OneToOne()
public Address getAddress() {...}
public void setAddress(Address address) {...}
} However, the Customer Entity JavaBean is an unserialized object which can cause serialization failure and crash the application when the J2EE container attempts to write the object to the system. Session scoped objects must implement the Serializable interface to ensure that the objects serialize properly. (Good Code) Example
Language: Java public class Customer implements Serializable {...} Potential Mitigations
Other Notes
Relationships
Content History
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Page Last Updated:
September 12, 2011
|
|
CWE is a Software Assurance strategic initiative co-sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is sponsored and managed by The MITRE Corporation to enable stakeholder collaboration. Copyright © 2006-2012, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information. |
|
|