Secure Coding in Java

Injection Attacks:

• Interpreted code
• User input formed maliciously
• System interprets input as a part of normal operation
• Unanticipated behavior

Common Types

• SQL
• LDAP (Lightweight Directory Access Protocol)
• XSS/CSS (Cross site scripting)
• CRLF (Carriage Return and Line Feed)
• XPath
• SMTP/IMAP
• Code injection
• OS Command injection
• Host header injection

SQL Injection:

SQL Injection Situation

• SQL statement formed with variables
• String concatenation
• Malicious input repurposes SQL statement
• Example: foo ' or '1' = ' 1

SQL Injection Prevention

• Use the concept of PreparedStatement
• SQL statements accept variable as "?" placeholder
• Bind variable attached to statements, not query

LDAP Injection:

• Caused by lack of sanitizing input
• (&(sn=<USERSN>(userpassword=<USERPASSWORD>))
• Consider f* for USERSN with * for USERPASSWORD

XPath Injection:

• Caused by lack of sanitizing input
• Vey similar to SQL injection in function
• Can be dangerous in injecting and manipulating data in XSLT contexts
• Parameterized query input

Sensitive Data Leaks:

• Any data is controlled by governing body
• Personal identifiable information (PII)
• Health Information data
• Financial Information (PCI)
• System Information (e.g Stack trace)
• Confidential Information (Employee data, Financial Info.)
• Handle all exception through common mechanisms
• Use consisting messaging 
• Deny First

Limit Accessibility:

• Public access for anything safe to be consumed
• Package private if hidden
• Package.access
• Consider method modifiers
• Seal packages in JAR manifest (Class loader protect)

Mutability:

• Make a class immutable 
• Private final attributes
• Optional private constructors (Static builder pattern)
• Clone mutable outputs and copy inputs (Work on deep copy not on reference)
• Create safe copy functionality
• Don't trust equality
• Wrapper methods for state change

Why Immutable?

• Prevent data issues
• Control all paths in your code
• Command expected results
• Prevent bugs, not just security related ones

Extensibility: (Inheritance/Interface)

• Design classes for inheritance
• Declare classes final (not extended)
• Prefer composition to inheritance (Make contract)
• Superclass features

Build Vulnerabilities:

• Run a dependency check plugin
• Use the data and fix dependency versions
• Java version (Used updated java version and target version properly)
• Testing (Run unit test)
• Unit test should include security testing to perform SQL injection
• Scan your code looking for security flaws
• Commercial and open-source offerings available
• Be prepared for false positives

Input Validations:

• Reusable validation logic (Common framework)
• Clean and easy to read
• Consistent error responses
• Thread safe code
• Implicit call
• Bean validation (JSR defined)
• Default validators (Pattern based etc.)
• Customizable validators
• Annotation based
• Lives on your domain objects
• Provide for what is accepted (Prefer positive check)
• Avoid inflexible denials
• Usually relies on RegEx

Serialization:

• Mechanics for class data access
• Bypasses filed access controls
• Input can be injected maliciously
• Cannot be avoided for most applications
• Don't serialize sensitive classes
•  Guard sensitive data
• Treat deserialization as object constructions
• Use SecurityManager 
• Filter untrusted data