New detector for MET03-J

[NazirMuhammadZafarIqbal]

I have implemented a checker named "FindVulnerableSecurityCheckMethods" for SEI CERT MET03-J

The checker proved to be effective in identifying potential security vulnerabilities in Java code. By enforcing the declaration of methods that use security checks as private or final, this checker helps reduce the risk of security breaches.

I have both White Box and Black Box Testing. For White Box Testing, I have created 5 compliant and 18 non-compliant test cases. My checker passes all of the test cases. For Black Box Testing, I tested the checker on Elasticsearch and SpotBugs projects. In the Elasticsearch project, there was no detection (As it is not using SecurityManager class). In SpotBugs, I got 6 true positives and 0 false positives.

Results for Eclipse:
output_Eclipse.txt

Results for spotbugs Project:
5.0_SBTestRepoMessageandTestsFixing.txt

Detections by MET03-J in SpotBugs:
5.0_SBTestRepoMessageandTestsFixing_filtered.txt

Details and link to detections:
True Positive in javax.activation.CommandMap.setCommandMap: M V VSC: The method 'javax.activation.CommandMap.setDefaultCommandMap(CommandMap)' performs security check by using 'SecurityManager.checkSetFactory()' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At CommandMap.java:[line 57]

True Positive in [javax.activation.FileTypeMap.setDefaultFileTypeMap]:(https://github.com/kohsuke/javax.activation/blob/90efa5762cd2004076eb473b22e527ab02bd2e49/src/main/java/javax/activation/FileTypeMap.java#L98): M V VSC: The method 'javax.activation.FileTypeMap.setDefaultFileTypeMap(FileTypeMap)' performs security check by using 'SecurityManager.checkSetFactory()' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At FileTypeMap.java:[line 68]

True Positive in javax.activation.DataHandler.setDataContentHandlerFactory: M V VSC: The method 'javax.activation.DataHandler.setDataContentHandlerFactory(DataContentHandlerFactory)' performs security check by using 'SecurityManager.checkSetFactory()' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At DataHandler.java:[line 619]

True Positive in bugIdeas.Ideas_2011_08_10.setSecurityManager: M V VSC: The method 'bugIdeas.Ideas_2011_08_10.setSecurityManager(SecurityManager)' performs security check by using 'SecurityManager.checkPackageAccess(String)' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At Ideas_2011_08_10.java:[line 52]

True Positive in ReflectionIncreaseAccessibilityNegativeTest.create: M V VSC: The method 'ReflectionIncreaseAccessibilityNegativeTest.create(Class)' performs security check by using 'SecurityManager.checkPackageAccess(String)' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At ReflectionIncreaseAccessibilityNegativeTest.java:[line 21]

True Positive in (couldn't find the link. In the repo, this file is in a jar so couldn't get URL) M V VSC: The method 'javax.security.jacc.PolicyConfigurationFactory.getPolicyConfigurationFactory()' performs security check by using 'SecurityManager.checkPermission(Permission)' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At PolicyConfigurationFactory.java:[line 82]

True Positive in javax.activation.CommandMap.setCommandMap: M V VSC: The method 'javax.activation.CommandMap.setDefaultCommandMap(CommandMap)' performs security check by using 'SecurityManager.checkSetFactory()' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At CommandMap.java:[line 57]

True Positive in [javax.activation.FileTypeMap.setDefaultFileTypeMap]:(https://github.com/kohsuke/javax.activation/blob/90efa5762cd2004076eb473b22e527ab02bd2e49/src/main/java/javax/activation/FileTypeMap.java#L98): M V VSC: The method 'javax.activation.FileTypeMap.setDefaultFileTypeMap(FileTypeMap)' performs security check by using 'SecurityManager.checkSetFactory()' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At FileTypeMap.java:[line 68]

True Positive in javax.activation.DataHandler.setDataContentHandlerFactory: M V VSC: The method 'javax.activation.DataHandler.setDataContentHandlerFactory(DataContentHandlerFactory)' performs security check by using 'SecurityManager.checkSetFactory()' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At DataHandler.java:[line 619]

True Positive in bugIdeas.Ideas_2011_08_10.setSecurityManager: M V VSC: The method 'bugIdeas.Ideas_2011_08_10.setSecurityManager(SecurityManager)' performs security check by using 'SecurityManager.checkPackageAccess(String)' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At Ideas_2011_08_10.java:[line 52]

True Positive in ReflectionIncreaseAccessibilityNegativeTest.create: M V VSC: The method 'ReflectionIncreaseAccessibilityNegativeTest.create(Class)' performs security check by using 'SecurityManager.checkPackageAccess(String)' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At ReflectionIncreaseAccessibilityNegativeTest.java:[line 21]

True Positive in (couldn't find the link. In the repo, this file is in a jar so couldn't get URL) M V VSC: The method 'javax.security.jacc.PolicyConfigurationFactory.getPolicyConfigurationFactory()' performs security check by using 'SecurityManager.checkPermission(Permission)' method of Security Manager Class, but is overrideable. Declare the method final or private in order to resolve the issue. At PolicyConfigurationFactory.java:[line 82]

---

Make sure these boxes are checked before submitting your PR -- thank you!

• Added an entry into CHANGELOG.md if you have changed SpotBugs code