search

samdjstevens / java-totp

A java library for implementing Time-based One Time Passwords for Multi-Factor Authentication.
MIT License
422 stars 103 forks source link

Limit the extensibility of classes and methods #24

Open OlivierJaquemet opened 4 years ago

OlivierJaquemet commented 4 years ago

Apply Guideline 4-5 / EXTEND-5 from the Secure Coding Guidelines for Java SE

Design classes and methods for inheritance or declare them final [6]. Left non-final, a class or method can be maliciously overridden by an attacker. A class that does not permit subclassing is easier to implement and verify that it is secure. Prefer composition to inheritance.