Security with Static Nested classes JAVA

Question

I was supposed to write this code so that ArrIg is a static nested class of Pair. However, I declared them as independent classes, but the code still ran as expected. I understand why it still ran.

I understand that static prevents the ArrIg object from being called once Pair is called(assuming ArrIg was a nested class of Pair). Further, this violated the syntax for static nested class, but it still worked. What are some of the dangers I have exposed this code to ?

public class ClassPair {

  public static void main(String[] args) {
    // TODO Auto-generated method stub

    int[] Ig= {1,2,3,4};
    Pair pair= ArrIg.minmax(Ig);

    System.out.print("min :"+pair.getFirst()+" | max :"+pair.getSecond());
  }

}


class Pair {
  public Pair(int a, int b){
    first=a;
    second=b;
  }

  public int getFirst(){
    return first;
  }
  public int getSecond(){
    return second;
  }

  private int first, second=0;    
}


class ArrIg{

  public static Pair minmax(int [] a){

    int min= a[0];//1
    int max=a[0];//1

    for(int i=0; i<a.length;i++){

      if (min>a[i]) min =a[i];//1
      if (max<a[i]) max=a[i];//2,3,4
    }

    return new Pair(min ,max);
  }

}

You class `Pair` does not encapsulate its data enough - you should work on that. — MaxZoom, Jan 02 '17 at 04:18
@MaxZoom I just changed the private fields of first and second to private. Since I was to declare ArrIg as an inner class and I didn't what other more dangers have I exposed my code to — BattleDrum, Jan 02 '17 at 04:21
@EJP What do you mean by contradiction? Am I wrong by saying that static suppresses the creation of a ArrIg assuming ArrIg was an inner class? — BattleDrum, Jan 02 '17 at 04:39
You are wrong in using the term 'static inner', because it is self-contradictory, as I said. — user207421, Jan 02 '17 at 04:48
@EJP You can create static inner classes. see docs: https://docs.oracle.com/javase/tutorial/java/javaOO/nested.html. Was that why this was downvoted ? — BattleDrum, Jan 02 '17 at 04:50
@BattleDrum No you can't, and there is nothing in your citation that says otherwise. The term 'static inner' doesn't even appear there. What it *actually* says is 'Nested classes that are declared static are called static nested classes. Non-static nested classes are called inner classes'. And the normative reference, [JLS #8.1.3](http://docs.oracle.com/javase/specs/jls/se8/html/jls-8.html#jls-8.1.3), says 'An inner class is a nested class that is not explicitly or implicitly declared static.' — user207421, Jan 02 '17 at 04:51
@EJP You can create them. See docs. Scroll down. If that's not ok I'll post link to a book a revered author who calls it that — BattleDrum, Jan 02 '17 at 04:52
Both your citation and mine say otherwise. You can't argue with the JLS, and neither can your revered author. What you are talking about is static *nested* classes. — user207421, Jan 02 '17 at 04:53
@EJP So What you're saying is that a nested class is not called an inner class or an inner class or inside an outer class? I'm working on legacy code here and referring to a book form 2001. — BattleDrum, Jan 02 '17 at 04:56
That is neither what I said, nor what your citation said, nor what the JLS said. What they did say is up there in black and white. Read it again. Legacy code has nothing to do with it, and neither does your non-attributed non-quotation from your non-named book by your non-named author. — user207421, Jan 02 '17 at 04:58
Google this : another name for a nested class. Scroll down to the people also ask section. click on what is a nested class. The result is from oracle — BattleDrum, Jan 02 '17 at 05:01
You can cite as many sources as you like but unless they agree with the JLS they are wrong. Simple as that. Further debate is pointless. — user207421, Jan 02 '17 at 05:02
@EJP I will certainly do that. But my point is there are many names for many things. You might say parent class I might say super class. All that matters is we refer to the same thing. I just changed the title — BattleDrum, Jan 02 '17 at 05:07
*My* point is that the JLS *defines* what an inner class is in Java, and it is not static. Your question is about static nested classes. See also [this answer](http://stackoverflow.com/a/1353326/207421), and several others below it. Also [this one](http://stackoverflow.com/a/70358/207421). — user207421, Jan 02 '17 at 05:08
Your question is presently meaningless. It can't really be answered properly until you clarify your terminology. It's up to you. — user207421, Jan 02 '17 at 05:11

Stephen C · Answer 1 · 2017-01-02T06:17:12.967

Access modifiers and nested classes are not a security mechanism. Indeed, it is pretty much trivial to circumvent them via reflection. (The only scenario where it might matter is if you are attempting to implement a system with a security sandbox.

The real purpose for access modifiers and nested classes is to provide encapsulation. It is about is about design leakage (unwanted dependencies) rather than information leakage and more general security concerns.

In this particular example, the (hypothethical) danger is that Pair could be instantiated and used outside of the ClassPair encapsulation. That could (hypothetically) be harmful, but for something like the Pair class allowing this could be a good thing.

I would also add that you need to use the terminology properly if you want people to understand what you are saying. For instance "calling" an object is not meaningful. You call methods ... not objects.

Security with Static Nested classes JAVA

1 Answers1