防止RMI服务器代码修改
我正在编写一个使用 Java RMI 的客户端-服务器解决方案（通过 Cajo 项目）。
我想让服务器尽可能安全。据我所知，通过使用 Java 反射，恶意客户端将能够查看任何给定对象内的所有方法名称和字段名称，这些对象要么绑定在 RMI 注册表中，要么从服务器“代理”（在 Cajo 中，代理项是实际驻留在服务器上但客户端可以引用它的对象）。但是，恶意客户端是否能够查看任何程序逻辑或修改服务器上的任何代码？或者查看字段的实际内容怎么样？
请假设不允许对服务器进行物理访问，并且对服务器的唯一网络访问是通过 Cajo TCP 端口 (1198)。
谢谢
I'm writing a client-server solution which is using Java RMI (Via the Cajo project).
I want to make the server as secure as possible. I understand that by using Java reflection, a malicious client would be able to view all method names and field names inside any given object which has either been bound in the RMI regestry or "proxied" from the server (In Cajo, a proxied item is an object who actually resides on the server but the client can reference it). However, would a malicious client be able to view any program logic, or modify any code on the server? Or what about viewing the actual contents of the fields?
Please assume that physical access to the server is not allowed and the only network access to the server is via the Cajo TCP port (1198).
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
RMI 基于代理对象和序列化。
代理对象：这些对象仅包含接口中指定的方法，原始对象的所有其他方法和字段不存在于代理中，并且无法通过反射访问。由于所有方法在接口中都已经是公共的，因此不可能进行任何攻击。
序列化对象：是服务器端值的一对一副本，所有方法和字段都可以在客户端上访问，但对客户端副本的更改不会转发到服务器，因为两个副本都是独立的。具有修改字段的对象仍然可以用作 RMI 方法的参数，因此请在服务器上验证您的输入。
RMI is based on proxy objects and serialisation.
Proxy objects: these only contains methods specified in an interface, all other methods and fields of the original Object do not exist within the proxy and can't be accessed via reflection. No attacks are possible since all methods are already public in the interface.
Serialised objects: are one on one copies of the server side values, all methods and fields can be accessed on the client, but changes to the client copy are not forwarded to the server since both copies are independent. An object with modified fields can still be used as argument of an RMI method, so validate your input on the server.
正确。然而这些字段是什么？只是一个 IP 地址：端口和一些用于代理方法的幻数。无需担心，没有任何内容是客户端无法通过正常方式使用的。
不可以。除了通过代理之外，它无法访问服务器。它根本看不到实际的远程对象实现。
不，出于同样的原因。
Correct. However what are those fields? Just an IP address:port and some magic numbers for the methods being proxied. Nothing to worry about there, there's nothing being exposed that the client can't already use by normal means.
No. It doesn't have any access to the server other than via the proxy. It can't see the actual remote object implementations at all.
No, for the same reason.