为什么 Java 被标记为“安全”语言？

Why is Java labeled as a "secure" language?

提问by Marcus

I guess this is a general question, but I am going through introductory courses to java (SE/ME) and the study material claims that java is often used for "security purposes". It does not explain however what they mean by claiming that java incorporates good security.

我想这是一个普遍的问题，但我正在学习 java (SE/ME) 的入门课程，并且学习材料声称 java 经常用于“安全目的”。然而，它并没有解释他们声称 java 具有良好的安全性是什么意思。

Is it hacker proof? Does it produce highly stable software? What?

它是黑客证明吗？它是否产生高度稳定的软件？什么？

Security from my point of view (at the moment) is that it's in the hands of the developer writing the code, not the language itself?

从我的角度来看（目前）安全性在于它掌握在编写代码的开发人员手中，而不是语言本身？

采纳答案by Lie Ryan

IMHO, that's a very misleading statement. In Java, you cannot access out-of-bound arrays, and you don't have pointers, and thus several security flaws like stack corruption or buffer overflow is impossible to exploit in Java. But Java is not inherently more secure than any other language; it's just there is less chance to make mistakes that can cause security flaws. In effect, this reduces security flaws, but it's totally misleading to say Java is secure.

恕我直言，这是一个非常具有误导性的声明。在 Java 中，您无法访问越界数组，并且您没有指针，因此堆栈损坏或缓冲区溢出等几个安全漏洞在 Java 中是无法利用的。但是 Java 本质上并不比任何其他语言更安全；只是犯可能导致安全漏洞的错误的机会更少。实际上，这减少了安全漏洞，但说 Java 是安全的完全是误导。

回答by thomaspaulb

Because Java compiles as bytecodewhich then runs inside a Virtual machine, it cannot access the computer it runs on like a natively compiled program can.

因为 Java 编译为字节码，然后在虚拟机中运行，所以它不能像本地编译的程序一样访问它运行的计算机。

回答by Matthew

The general reason why Java is considered to be more secure than, say C, is because it handles memory management for you. In other languages, programmers allocate their own memory and often fail to do it correctly, causing buffer overflows, etc. Of course the Java VM could still contain the very same types of bugs, but it's well tested over time, unlike every user written program.

Java 被认为比 C 更安全的一般原因是因为它为您处理内存管理。在其他语言中，程序员分配自己的内存并且经常无法正确分配，导致缓冲区溢出等。当然，Java VM 仍然可能包含非常相同类型的错误，但它经过了长时间的良好测试，与每个用户编写的程序不同.

So in that respect, it is more secure. But you can still write insecure code, because no language could ever protect you from writing just plainly erroneous code.

所以在这方面，它更安全。但是您仍然可以编写不安全的代码，因为没有任何语言可以保护您免于编写明显错误的代码。

回答by nos

Several languages, most notably C and C++, have a class of bugs that can allow arbitary code to be executed when exploited - such bugs are quite common, and they're easy to make. These bugs are often some form of buffer overflow.

几种语言，尤其是 C 和 C++，都有一类错误，可以在被利用时允许任意代码执行——这种错误很常见，而且很容易制造。这些错误通常是某种形式的缓冲区溢出。

Java, and many other languages/platforms eliminate that class of bugs(bar potential exploitable bugs in the VM itself), which many will claim makes it more secure.

Java 和许多其他语言/平台消除了这类错误（禁止 VM 本身中潜在的可利用错误），许多人会声称这使其更安全。

回答by Michael Borgwardt

There are two things that make Java "more secure" than other language in certain aspects:

有两件事使 Java 在某些方面比其他语言“更安全”：

• Automatic array bounds checking and the lack of manual memory management make certain classes of programming mistakes that often cause serious security holes (such as buffer overruns) impossible. Most other modern languages share this feature, but C and C++, which were dominant (and still are major) application development languages at the time Java first appeared, do not.
• The Security Managerconcept makes it relatively easy to run Java applications in a "sandbox" that prevents them from doing any harm to the system they are running on. This played an important part in promoting Java during its early days, since Applets were envisioned as a ubiquitous, safe way to have client-side web applications.

• 自动数组边界检查和缺乏手动内存管理使得某些类别的编程错误无法实现，这些错误通常会导致严重的安全漏洞（例如缓冲区溢出）。大多数其他现代语言都具有此功能，但在 Java 首次出现时占主导地位（并且仍然是主要的）应用程序开发语言的 C 和 C++ 却没有。
• 在安全管理理念使得它比较容易在一个“沙箱”阻止他们做任何伤害他们的系统在运行上运行的Java应用程序。这在 Java 早期的推广中发挥了重要作用，因为 Applet 被设想为一种无处不在的、安全的客户端 Web 应用程序。

回答by Andy Thomas

Java provides guarantees and tools for security, such as:

Java 提供了安全保障和工具，例如：

• No buffer-overflow exploits
• Byte-code verification
• Security permissions for different codebases
• Security-related APIs

• 没有缓冲区溢出漏洞
• 字节码验证
• 不同代码库的安全权限
• 与安全相关的 API

For more details, see Oracle's "Java Security Overview".

有关更多详细信息，请参阅 Oracle 的“Java 安全概述”。

回答by Stan Kurilin

It is marketing)

这是营销）

回答by atul

1. This is basic question asked in some interview why java is secured its reason behind this as java is secure because inside jvm a software is present whose name is security manager whose responsibility is that handle all things, if something is happen wrong.so its control/preventing a system

2. Another thing is that it creates interface between source code and system(os),And no any permission of user to do something wrong.

1. 这是在一些采访中问到的基本问题，为什么 java 是安全的，其背后的原因是因为 java 是安全的，因为在 jvm 中存在一个软件，其名称是安全管理器，其职责是处理所有事情，如果出现问题。所以它的控制/防止系统

2. 另一件事是它在源代码和系统（os）之间创建了接口，并且没有用户的任何权限做错。

回答by Rajesh

Also Generic types (or generics) bear a superficial resemblance to templates in C++, both in their syntax and in their expected use cases (such as container classes). But the similarity is only skin-deep -- generics in the Java language are implemented almost entirely in the compiler, which performs type checking and type inference, and then generates ordinary, non-generic bytecodes. This implementation technique, called erasure (where the compiler uses the generic type information to ensure type safety, but then erases it before generating the bytecode), has some surprising, and sometimes confusing, consequences. While generics are a big step forward for type safety in Java classes, learning to use generics will almost certainly provide some opportunity for head-scratching (and sometimes cursing) along the way.

此外，泛型类型（或泛型）在语法和预期用例（例如容器类）上都与 C++ 中的模板有表面上的相似之处。但相似之处只是肤浅的——Java 语言中的泛型几乎完全在编译器中实现，编译器执行类型检查和类型推断，然后生成普通的非泛型字节码。这种称为擦除的实现技术（编译器使用泛型类型信息来确保类型安全，但在生成字节码之前将其擦除）会产生一些令人惊讶且有时令人困惑的后果。虽然泛型是 Java 类中类型安全的一大进步，但学习使用泛型几乎肯定会在此过程中提供一些令人头疼（有时甚至是诅咒）的机会。

回答by user2287187

Java compiler converts the Java code into byte code (.class file) and these byte codes are then run by Java Virtual Machine (JVM) . JVM is an interpreter which is installed in each client machine that is updated with latest security updates by internet . When this byte codes are executed , the JVM can take care of the security. So, java is said to be more secure than other programming languages.

Java 编译器将 Java 代码转换为字节码（.class 文件），然后这些字节码由 Java 虚拟机 (JVM) 运行。JVM 是安装在每台客户端机器上的解释器，它通过 Internet 更新为最新的安全更新。当这个字节码被执行时，JVM 可以负责安全性。因此，据说java比其他编程语言更安全。