diff --git a/java/ql/src/experimental/Security/CWE/CWE-665/CorrectJmxEnvironmentInitialisation.java b/java/ql/src/experimental/Security/CWE/CWE-665/CorrectJMXConnectorServerFactoryEnvironmentInitialisation.java similarity index 100% rename from java/ql/src/experimental/Security/CWE/CWE-665/CorrectJmxEnvironmentInitialisation.java rename to java/ql/src/experimental/Security/CWE/CWE-665/CorrectJMXConnectorServerFactoryEnvironmentInitialisation.java diff --git a/java/ql/src/experimental/Security/CWE/CWE-665/CorrectRmiEnvironmentInitialisation.java b/java/ql/src/experimental/Security/CWE/CWE-665/CorrectRMIConnectorServerEnvironmentInitalisation.java similarity index 100% rename from java/ql/src/experimental/Security/CWE/CWE-665/CorrectRmiEnvironmentInitialisation.java rename to java/ql/src/experimental/Security/CWE/CWE-665/CorrectRMIConnectorServerEnvironmentInitalisation.java diff --git a/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.qhelp b/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.qhelp index 55d5e3c63e2..c74d5a9d4b4 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.qhelp +++ b/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.qhelp @@ -26,26 +26,11 @@ The filter should (ideally) only allow java.lang.String and disallow all other c
The key-value pair can be set as following:
-
-String stringsOnlyFilter = "java.lang.String;!*"; // Deny everything but java.lang.String
-
-Map<String, Object> env = new HashMap<String, Object>;
-env.put(RMIConnectorServer.CREDENTIALS_FILTER_PATTERN, stringsOnlyFilter);
-
+For applications using Java 6u113 to 9:
-
-// This is deprecated in Java 10+ !
-Map<String, Object> env = new HashMap<String, Object>;
-env.put (
- "jmx.remote.rmi.server.credential.types",
- new String[]{
- String[].class.getName(),
- String.class.getName()
- }
- );
-
+Please note that the JMX-RMI service is vulnerable in the default configuration.
For this reason an initialization with a null environment is also vulnerable.
null environment is also v
The first example shows how an JMX server is initialized securely with the JMXConnectorServerFactory.newJMXConnectorServer() call.
The second example shows how a JMX Server is initialized securely if the RMIConnectorServer class is used.