Question

CPSC 4361: Secure software engineering

Need answer asap

1.

Given the below Java method, are there any (syntactical, semantical, logical) errors? What can be improved from the security-compliance perspective? If there are security-related issues, how can we fix them?

public class FinalExam {

private int noStudents;

private static final int MAX_SEATS = 26;

public void counter() {

noStudents = 0;

while (condition()) {

/* ... */

if (noStudents++ > MAX_SEATS) {

System.out.println("Room 215 does not have so many seats");

return;

}

}

}

private boolean condition() {/* ... */}

// No other method references noStudents

// but several other methods reference MAX_SEATS

}

}

Answer 1

The Java method has no syntactical or semantical errors. For better security-compliance, ensure the condition() method doesn't lead to security vulnerabilities, and consider the incrementation of noStudents and its scope.

Step-by-step explanation:

In examining the provided Java method for security-compliance, there appears to be no syntactical or semantical errors, but some improvements can be made from a security perspective. Firstly, the method condition is private and its implementation is not shown, but it should be thoroughly reviewed to ensure it does not contain security vulnerabilities, like susceptibility to infinite loops which could lead to a Denial of Service (DoS) if it never returns false.

The counter method could also be improved. It increments noStudents before checking against MAX_SEATS, which means it could potentially increment it to 27 before stopping, which slightly contradicts the maximum defined by MAX_SEATS. A better approach would be to use a pre-increment in the condition (if (++noStudents > MAX_SEATS)) or to increment noStudents after checking the condition.

Lastly, since no other methods reference noStudents and it is only modified within this method, its scope could be limited further by declaring it within the counter method to reduce its visibility, thus minimizing the attack surface and adhering to the principle of least privilege.