Question

Is Polymorphism in programming related in any way to secure programming? explain and provide example.

Answer 1

`Hey,

Note: Brother if you have any queries related the answer please do comment. I would be very happy to resolve all your queries.

Secure. the whole point of polymorphism is that you can pass around objects that look like Animals but are in fact Giraffes. There are potential security issues here.

Every time you implement a method which takes an instance of an unsealed type, you MUST write that method to be robust in the face of potentially hostile instances of that type. You cannot rely upon any invariants which you know to be true of YOUR implementations, because some hostile web page might subclass your implementation, override the virtual methods to do stuff that messes up your logic, and passes it in. Every time I seal a class, I can write methods that use that class with the confidence that I know what that class does.

For ex

class MultiplyFun {

  

    // Method with 2 parameter

    static int Multiply(int a, int b)

    {

        return a * b;

    }

  

    // Method with the same name but 3 parameter

    static int Multiply(int a, int b, int c)

    {

        return a * b * c;

    }

}

  

class Main {

    public static void main(String[] args)

    {

        System.out.println(MultiplyFun.Multiply(2, 4));

  

        System.out.println(MultiplyFun.Multiply(2, 7, 3));

    }

}

3

Let's say you create a security validation class, which is passed to your main form by an IoC. Because you use this structure for a few different systems, like a good little programmer you create a base class with most of the logic, and put system-specific code in the derived classes.

An attacker takes a look, and finds this Template Method pattern. He also sees that a key piece of the puzzle, a property "SecurityDBConnString", is abstract (because it's used by base class logic but can't be specified there as it's system-specific), and when you overrode it for the system he's interested in, you didn't seal it. The attacker fires up his cracked VS copy, derives his own class from yours, further overriding SecurityDBConnString to point to a system he controls, then modifies the IoC registrations to pass in his new class. Now he's in, and you're in trouble.

Kindly revert for any queries

Thanks.