These notes will assume you’re a fairly capable Java programmer. In particular, you should already know:
Java is at least a memory-managed language, meaning you don’t have to allocate and deallocate memory on your own. You simply ask to create new objects and space is found for them on the heap. When objects are no longer accessible, a garbage collector will reclaim the memory.
You may not get the classic buffer overflows possible in C and C++, but there are still many ways Java code can be vulnerable. A couple standards and guidelines are out there that can help you write more secure Java. Two well-known ones are one from Oracle and one from CMU SEI.
This single page document covering Java software security is easy to read and full of examples. The guidelines are broadly organized into the following sections:
Within each section are specific guidelines, many with code examples.
There’s a fantastic amount of information at The SEI CERT Oracle Coding Standard for Java from the Software Engineering Institute at Carnegie Mellon.
The Standard is organized into a number of Guidelines, divided into Rules and Recommendations, grouped into sections numbered and titled as follows:
Rules are basically requirements that if violated will almost surely result in an exploitable vulnerability. They are generally in principle checkable by static analysis tools (or by a competent human code reviewer). Recommendations basically improve software quality, but violations are not necessarily defects.
Examples of Rules:
Examples of Recommendations:
The online standard has a page listing all of the rules and a page listing all of the recommendations. You can begin your study simply by reading the title of each of the rules and recommendations. Then dive into the ones of interest.
Reading the whole standard can be worthwhile too! There’s sime nice introductory material, explanations of the standard’s organization and how to get the most from it, some history, and discussion of its relationship with other standards and publications. The Back Matter section has some good stuff too.
We’re going to browse a few of these guidelines!
Notice how many rules in CERT Java have something to with concurrency? No surprise. Java allows multithreaded programming, which is, well, hard. And one big issue is that many of the things beginners learn about the language negatively impact security. Here are a few tips to get you in the right mindset for programming securely with threads in Java:
synchronized. The internal lock a synchronized method uses applies to the entire object, which is often way too coarse, and this can kill performance (with needless waiting of other threads, timeouts). They may be fine for small objects but often you are better off choosing a special purpose mechanism, like a ReadWriteLock. Or just use immutable objects, which you don’t have to lock.When developing in Java, you should use a source code analyzer. Two that are very popular and worth considering are:
Let’s demo one or both of these.
We’ve covered: