Java Reference
In-Depth Information
Noncompliant Code Example
This noncompliant code example uses a
UserLookupCallBack
class that implements the
CallBack
interface to look up a user's name given the user's ID. This lookup code as-
sumes that this information lives in the
/etc/passwd
file, which requires elevated priv-
ileges to open. Consequently, the
Client
class invokes all callbacks with elevated priv-
ileges (within a
doPrivileged
block).
public interface CallBack {
void callMethod();
}
class UserLookupCallBack implements CallBack {
private int uid;
private String name;
public UserLookupCallBack(int uid) {
this.uid = uid;
}
public String getName() {
return name;
}
public void callMethod() {
try (InputStream fis = new FileInputStream("/etc/passwd")) {
// Look up uid & assign to name
} catch (IOException x) {
name = null;
}
}
}
final class CallBackAction {
private CallBack callback;
public CallBackAction(CallBack callback) {
this.callback = callback;
}
public void perform() {
AccessController.doPrivileged(new PrivilegedAction<Void>() {
public Void run() {
