Description

Detects dangerous combinations of Java security permissions that could lead to security bypass. The combination of ReflectPermission("suppressAccessChecks") or RuntimePermission("createClassLoader") can allow attackers to bypass Java's security manager and access controls, potentially leading to unauthorized access to restricted functionality.

Detection Strategy

• Check if code imports java.security.RuntimePermission or java.lang.reflect.ReflectPermission

• Look for ReflectPermission instantiation with 'suppressAccessChecks' parameter

• Look for RuntimePermission instantiation with 'createClassLoader' parameter

• Report a security issue when either of these dangerous permission combinations is found

Vulnerable code example

import java.security.PermissionCollection;
import java.security.Permissions;
import java.security.RuntimePermission;
import java.lang.reflect.ReflectPermission;

public class VulnerablePermissions {
    public static void main(String[] args) {
        PermissionCollection permissions = new Permissions();...

✅ Secure code example

import java.security.PermissionCollection;
import java.security.Permissions;
import java.security.RuntimePermission;

public class SecurePermissions {
    public static void main(String[] args) {
        PermissionCollection permissions = new Permissions();
        ...