public class CallerSensitiveDetector extends Object
sun.reflect
package, and an unprivileged one that is used when Dynalink doesn't have access to that
package. Note that even the unprivileged strategy is ordinarily robust, but it relies on the toString
method
of the annotation. If an attacker were to use a different annotation to spoof the string representation of the
CallerSensitive
annotation, they could designate their own methods as caller sensitive. This however does not
escalate privileges, only causes Dynalink to never cache method handles for such methods, so all it would do would
decrease the performance in linking such methods. In the opposite case when an attacker could trick Dynalink into not
recognizing genuine CallerSensitive
annotations, Dynalink would treat caller sensitive methods as ordinary
methods, and would cache them bound to a zero-privilege delegate as the caller (just what Dynalink did before it
could handle caller-sensitive methods). That would practically render caller-sensitive methods exposed through
Dynalink unusable, but again, can not lead to any privilege escalations. Therefore, even the less robust unprivileged
strategy is safe; the worst thing a successful attack against it can achieve is slight reduction in Dynalink-exposed
functionality or performance.Copyright © 2013 Attila Szegedi. All rights reserved.