By default, the Verifier is disabled on .Net and Java

[michaelslists at gmail.com (Michael Silk)]

On 5/9/06, Dinis Cruz <dinis at ddplus.net> wrote:
> Stephen de Vries wrote:
> > Java has implemented this a bit differently, in that the byte code
> > verifier and the security manager are independent.  So you could for
> > example, run an application with an airtight security policy (equiv to
> > partial trust), but it could still be vulnerable to type confusion
> > attacks if the verifier was not explicitly enabled.  To have both
> > enabled you'd need to run with:
> > java -verify -Djava.security.policy ...
>
> This is a very weird decision by the Java Architects, since what is the
> point of creating and enforcing a airtight security policy if you can
> jump strait out of it via a Type Confusion attack?
>
> In fact, I would argue that you can't really say that you have an
> 'airtight security' policy if the verifier is not enabled!

You can't disable the security manager even with the verifier off. But
you could extend some final or private class that the security manager
gives access to.


> Is there a example out there where (by default) java code is executed in
> an environment with :
>
>     * the security manager enabled (with a strong security policy) and
>     * the verifier disabled

Yes. Your local JRE.

-- Michael