【问题标题】:why is this considered insecure? [closed]为什么这被认为是不安全的? [关闭]
【发布时间】:2020-01-03 15:27:03
【问题描述】:

最近,我在 Java MVC 框架中编写了一个简单的游戏,一位高级程序员在审查时告诉我,使用 score 是不安全的,它的 getter 和 setter 在玩家模型本身中定义。不幸的是,我无法从他们那里获得更多信息,说明它是如何以及为什么看起来如此,我无法弄清楚为什么。

有人可以查看这些类并指出为什么不建议使用这种架构吗?

播放器模型:


public class player implements Comparable<player>{
    private int score;
    private int consecutive_misses;
    private String name;
    private int foul_count;
    private int turn;
    private boolean win;

    public player()
    {
        this.score=0;
        this.consecutive_misses=0;
        this.foul_count=0;
        this.win=false;
    }
    public void setWin(boolean win)
    {
        this.win=win;
    }
    public boolean getWin()
    {
        return this.win;
    }

    public void setPlayerName(String name)
    {
        this.name=name;

    }
    public void setTurn(int turn)
    {
         this.turn=turn;
    }

    public int getTurn()
    {
        return this.turn;
    }
    public void addScore(int score)
    {
        this.score+=score;
    }
    public String getName()
    {
        return this.name;
    }


    public int getScore(){
        return this.score;
    }
     public void resetFoulCount() {
            this.foul_count = 0;
    }
     public void incrementFoulCount() {
            this.foul_count++;
    }
     public int getFoulCount()
     {
         return this.foul_count;
     }

     public void resetConsecutiveMisses() {
            this.consecutive_misses = 0;
    }
     public void incrementConsecutiveMisses() {
            this.consecutive_misses++;
    }
      public int getConsecutiveMisses()
      {
          return this.consecutive_misses;
      }
      public int compareTo(player comparePlayer)
      {
          int compareScore=((player) comparePlayer).getScore();
          return compareScore-this.score;
      }


}```

the main game model class where i implemented player model

package com.tiffany.CleanStrike_1.models;

import java.util.HashMap;
import java.util.Map;


public class gameModel {

     private int player_count;
     private player[] players;
     private player current_player;
     private player winner=new player();
     private gameState game_state;
     private boolean draw=false;
     private carromBoard carrom_board;



     public gameModel(int player_count,int black_coin_count,int red_coin_count,int black_val,int red_val)
     {

         this.game_state=gameState.DORMANT;
         this.players=new player[player_count];

        for(int i=0;i<player_count;i++)
        {
            this.players[i]=new player();
        }

         this.setPlayerCount(player_count);
         Coin black_coin=new Coin(CoinColour.BLACK,black_val);
         carrom_board=new carromBoard();
         this.carrom_board.addCoin(black_coin,black_coin_count);
         Coin red_coin=new Coin(CoinColour.RED,red_val);
         this.carrom_board.addCoin(red_coin,red_coin_count);


     }

     public int getNoOfCoins(CoinColour colour)
     {
         Map<Coin,Integer> coins=new HashMap<Coin,Integer>();
            coins=this.getCoinsOnBoard();
            for(Coin coin: coins.keySet())
            {
                if(coin.getColour()==colour)
                    return coins.get(coin);
            }
         return 0;
     }

     public  void setPlayerName(int i,String name)
     {
         this.players[i].setPlayerName(name);

     }

     public  void setGameDraw()
     {
         this.draw=true;

     }
     public  boolean getGameDraw()
     {
         return this.draw;

     }
     public  void setGameState(gameState game_s)
     {
         this.game_state=game_s;
     }
     public gameState getGameState()
     {
         return this.game_state;
     }

     public int getCountOfAllCoins()
     {
         return this.carrom_board.getCountOfAllCoins();
     }

     public int getCoinValue(CoinColour colour)
     {
         for ( Coin coin : this.carrom_board.getCoins().keySet() ) {
             if(coin.getColour()==colour) {
                 return coin.getValue();
                }
            }
         return 0;

     }

     public void setWinner(player w)
     {
         this.winner=w;
     }
     public player getWinner()
     {
         return this.winner;
     }

     public void setCurrentPlayer(player p)
     {
         this.current_player=p;
     }
     public player getCurrentPlayer()
     {
         return this.current_player;
     }
     public void setPlayerCount(int count)
     {
         this.player_count=count;
     }
     public int getPlayerCount()
     {
         return this.player_count;
     }


     public Map<Coin,Integer> getCoinsOnBoard()
     {
        return this.carrom_board.getCoins();


     }
     public void removeCoin(CoinColour colour,int count)
     {
         this.carrom_board.removeCoin(colour, count);


     }
     public player[] getPlayers()
     {
         return this.players;

     }



}

【问题讨论】:

  • 考虑在Code Review 提问。并考虑再次询问高级工程师 - 教育更多初级工程师是他工作的一部分。
  • 从技术上讲,如果您允许为玩家设置分数,这意味着任何持有该玩家的人都可以这样做,而系统的其他部分不知道分数的来源。分数应该从系统的中心点分发,并且从任何玩家的角度来看都应该是只读的。我什至会争辩说,分数不是玩家的属性,它是你可以从游戏或规则对象中询问的东西。但是你绝对应该问你的前辈他们的意思,我们不是说当前设计不适合目的的人。
  • 这些在您的代码中都是有效的:player.setPlayerName(null); player.setTurn(-10000); model.setWinner(new Player()); model.setCurrentPlayer(null); model.getPlayers()[0]=null; 换句话说,根本不进行任何检查,从而损害了类的约束/不变量。如果不确保这些约束,程序崩溃时很难查明原因。

标签: java security model-view-controller model


【解决方案1】:

一个类不应该暴露它的内部结构。通过暴露其内部结构,它违反了许多法律,例如德墨忒耳法则,其他职业可以利用这种情况并设置他们想要的任何分数。您可以在 Clean Code 一书中了解更多相关信息。

【讨论】:

    猜你喜欢
    • 2011-08-25
    • 1970-01-01
    • 2021-02-04
    • 2014-03-08
    • 2014-03-26
    • 2011-08-13
    • 2012-11-19
    • 1970-01-01
    • 1970-01-01
    相关资源
    最近更新 更多