The J2EE application directly uses sockets instead of using framework method calls.
The J2EE standard permits the use of sockets only for the purpose of communication with legacy systems when no higher-level protocol is available. Authoring your own communication protocol requires wrestling with difficult security issues. Without significant scrutiny by a security expert, chances are good that a custom communication protocol will suffer from security problems. Many of the same issues apply to a custom implementation of a standard protocol. While there are usually more resources available that address security concerns related to implementing a standard protocol, these resources are also available to attackers.
Threat Mapped score: 1.8
Industry: Finiancial
Threat priority: P4 - Informational (Low)
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
Intro: The following example opens a socket to connect to a remote server.
Body: A Socket object is created directly within the Java servlet, which is a dangerous way to manage remote connections.
public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // Perform servlet tasks. ... // Open a socket to a remote server (bad). Socket sock = null; try { sock = new Socket(remoteHostname, 3000); // Do something with the socket. ... } catch (Exception e) { ... } }