JDK 7 Thread Cloning Vulnerability
Posted by: IKVM.NET Weblog,
on 23 Jun 2011 |
View original | Bookmarked: 0 time(s)
I warned
on the mailing list when this came up, but apparently was ignored,so maybe a blog
post will help.
In one of last year's updates of JDK 6 the cloning vulnerability was fixed in
a hackish, but clever and safe way. Now in JDK 7 they try to fix it by overriding
Object.clone() with a version that simply throws CloneNotSupportedException. The only
problem is, in Java (and .NET too) overriding a method is not a safe way to make the
base class...