The product violates the Enterprise JavaBeans (EJB) specification by using sockets.
The Enterprise JavaBeans specification requires that every bean provider follow a set of programming guidelines designed to ensure that the bean will be portable and behave consistently in any EJB container. In this case, the product violates the following EJB guideline: "An enterprise bean must not attempt to listen on a socket, accept connections on a socket, or use a socket for multicast." The specification justifies this requirement in the following way: "The EJB architecture allows an enterprise bean instance to be a network socket client, but it does not allow it to be a network server. Allowing the instance to become a network server would conflict with the basic function of the enterprise bean-- to serve the EJB clients."
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
Intro: The following Java example is a simple stateless Enterprise JavaBean that retrieves stock symbols and stock values. The Enterprise JavaBean creates a socket and listens for and accepts connections from clients on the socket.
Body: And the following Java example is similar to the previous example but demonstrates the use of multicast socket connections within an Enterprise JavaBean.
@Stateless public class StockSymbolBean implements StockSymbolRemote { ServerSocket serverSocket = null; Socket clientSocket = null; public StockSymbolBean() { try { serverSocket = new ServerSocket(Constants.SOCKET_PORT); } catch (IOException ex) {...} try { clientSocket = serverSocket.accept(); } catch (IOException e) {...} } public String getStockSymbol(String name) {...} public BigDecimal getStockValue(String symbol) {...} private void processClientInputFromSocket() {...} }