Avoid calling overridable function from constructor
When a constructor calls an overridable function, it may allow an attacker to access the "this" reference prior to the object being fully initialized, which can in turn lead to a vulnerability. Application -> getLocalPath ProxyPanel -> get AbortPanel -> get RotatingBackgrounds -> makeEmpty (Triggered by internal security audit and Fortify analysis.)
This commit is contained in:
@@ -28,14 +28,14 @@ import static com.threerings.getdown.Log.log;
|
||||
/**
|
||||
* Displays a confirmation that the user wants to abort installation.
|
||||
*/
|
||||
public class AbortPanel extends JFrame
|
||||
public final class AbortPanel extends JFrame
|
||||
implements ActionListener
|
||||
{
|
||||
public AbortPanel (Getdown getdown, ResourceBundle msgs)
|
||||
{
|
||||
_getdown = getdown;
|
||||
_msgs = msgs;
|
||||
|
||||
|
||||
setLayout(new VGroupLayout());
|
||||
setResizable(false);
|
||||
setTitle(get("m.abort_title"));
|
||||
|
||||
@@ -30,7 +30,7 @@ import static com.threerings.getdown.Log.log;
|
||||
* Displays an interface with which the user can configure their proxy
|
||||
* settings.
|
||||
*/
|
||||
public class ProxyPanel extends JPanel
|
||||
public final class ProxyPanel extends JPanel
|
||||
implements ActionListener
|
||||
{
|
||||
public ProxyPanel (Getdown getdown, ResourceBundle msgs)
|
||||
|
||||
@@ -10,7 +10,7 @@ import java.util.List;
|
||||
|
||||
import static com.threerings.getdown.Log.log;
|
||||
|
||||
public class RotatingBackgrounds
|
||||
public final class RotatingBackgrounds
|
||||
{
|
||||
public interface ImageLoader {
|
||||
/** Loads and returns the image with the supplied path. */
|
||||
|
||||
@@ -36,7 +36,7 @@ import static com.threerings.getdown.Log.log;
|
||||
/**
|
||||
* Displays download and patching status.
|
||||
*/
|
||||
public class StatusPanel extends JComponent
|
||||
public final class StatusPanel extends JComponent
|
||||
implements ImageObserver
|
||||
{
|
||||
public StatusPanel (ResourceBundle msgs)
|
||||
|
||||
Reference in New Issue
Block a user