what is the solution for IBM AppScan tool PrivilegeEscalation

[Robert Jack]

Hi Team,

I scanned my project using IBM AppScan tool. The tool is generated report and it contains one 'Medium' defect type.
The defect type is: 'PrivilegeEscalation' and category is:  CWE-266: Incorrect Privilege Assignment

Defect detail:

About Issue: PrivilegeEscalation - com.application.....ect;Object):int null

PrivilegeEscalation
Severity: Medium
API: java.lang.reflect.Method.invoke(Object;Object[]); Object
Caller: com.application.TestComparator.compare(Object:Object):int at line 19

Call

method.invoke(classObject.cast(object1),new Object()[][0])

My Java Code is:

package com.application;

import java.lang.reflect.Method;
import java.util.Comparator;

public class TestComparator implements Comparator {

    private Class classObject;
    private String functionName;

    public TestComparator(Class pojoClass,String methodName){
        this.classObject = pojoClass;
        this.functionName = methodName;
    }

    public int compare(Object object1, Object object2) {
        try{
            Method method =classObject.getMethod(("get"+functionName));
            String value1 =method.invoke(classObject.cast(object1)).toString();
            String value2 =method.invoke(classObject.cast(object2)).toString();
            return value2.compareTo(value1);
        }catch(Exception ex){
            //  ex.printStackTrace();
        }
        return 0;
    }
}

I am not able to find the solution.
Please help me
Thanks in advance

[Tim Cooke]

I expect the complaint is that you're using the reflection library to get hold of class and method objects in order to perform some comparison on them. By virtue of using reflection you are circumventing the access scope assigned to those resources, hence the "Incorrect Privilege Assignment" complaint. That's my best assessment at least and could be incorrect.

My primary concern with this code is the use of the reflection library. I don't see a good reason for it.

[Robert Jack]

Thanks Tim Cooke for your response.

Yes. We are using reflection API. But i am not clear how to solve this defect type.

[Tim Cooke]

My first attempt would be to find a solution that does not use Reflection.

Besides, this Comparator implementation makes no sense to me at all. You are comparing two String types which is very simple, yet you've complicated things hugely by adding into the Comparator the responsibility of obtaining those Strings through a method call on an Object, and then you go on to make it so generic that the implementation is horrible. A Comparator should do one thing and one thing only, and that's to compare two values. The responsibility of obtaining those values belongs elsewhere.