Coffee break #33. 3 Useful Tips for Security in Java Development. 4 Ways to Analyze Code Every Developer Should Know About

3 Useful Tips for Security in Java Development

Source: DZone Despite the fact that Java has been around since the 1990s, it is still one of the most popular programming languages. Developers use Java to effectively solve many problems, including those related to other languages. In addition, it can be used to create solutions of any complexity. Another advantage of Java is that a high level of security can be achieved using this language. Of course, you shouldn't take it for granted. Ensuring security when building a Java application is one of the top priorities for developers. Failure to comply with this rule will lead to the fact that your company will face distrust from consumers. So that you can avoid this situation, we have prepared some practical tips that could be useful for you when developing web applications in Java.

SQL Injection Protection

SQL injection is one of the most serious vulnerabilities. With its help malefactors gain access to confidential data. The problem arises when a hacker intercepts an application's database requests and uses them to gain access to user information and then for any other illegal purpose. Of course, you can protect yourself from all this. It is up to you to make it so that attackers cannot use SQL injection attacks in your application: for example, by parameterizing queries. To do this, you need to use a prepared statement. Ideally, developers should only use this method to create requests. Below is a Java code example to help you better understand how this is done:

public void prepStatmentExample(String parameter) throws SQLException {
   Connection connection = DriverManager.getConnection(DB_URL, USER, PASS);
   String query = "SELECT * FROM USERS WHERE lastname = ?";
   PreparedStatement statement = connection.prepareStatement(query);
   statement.setString(1, parameter);
   System.out.println(statement);
   ResultSet result = statement.executeQuery();
   printResult(result);
}

Check third party libraries

This is one of the most important tips that any Java development team should follow. It is important because it allows you to once again make sure that the code does not contain a vulnerability. By neglecting to check third-party libraries, you will simply destroy the quality and reputation of your web application. It also helps you better detect bugs, performance issues, and more.

Use data with great care

Each web application usually contains a lot of sensitive data such as customer banking details and the like. Therefore, it is important for programmers to be very careful when handling such information. It is better to calculate in advance when and what sensitive data your application will request. And don't forget to clear the toString() methods in the domain entity. Development of web applications in Java, if it takes into account all security requirements, can help not only customers, but also companies. You can rest assured that security will make it much easier for you to take your business to the next level.

4 Ways to Analyze Code Every Developer Should Know About

Source: TechBeacon You've probably heard the term "static analysis". Most often, it means any one well-known tool or method. But in fact there are several varieties of static analysis, each of which has a certain meaning when used. The most mentioned code analysis is called SAST (Static Application Security Testing - static application security testing). This is considered to be the best testing method. But besides it, you can use additional methods, because each of them detects different types of errors. Here are four types of code analysis that I encourage you to learn. Each of them has its own advantages.

Performance

Static analysis tools help to detect coding patterns that reduce performance. For example, BoxedPrimitiveConstructor looks for patterns like "new Boolean (true)". In earlier versions of Java, it was often used, but now there are better methods. By using static analysis tools to detect these performance anti-patterns, you eliminate the possibility of them getting into your codebase. These tools are also useful in terms of education: they signal to experienced developers that coding best practices have changed and show beginners the best way to cope with the task at hand.

Reliability

Issues such as NullPointerException in Java or resource leaks in C usually don't affect security. But they need to be monitored and fixed, as these issues can lead to unexpected behavior or loss of time due to downtime. Agree, no one wants to receive a message or a call at 3 in the morning that your service is down. Reliability-focused static analysis tools can help prevent this scenario. For example, Facebook's Infer toolcapable of detecting NullPointer issues, memory leaks, and security/thread synchronization issues. Since memory leaks and threading issues are notoriously difficult to find and debug, static analysis tools are especially useful for this type of error: they save the developer time and improve performance in the long run.

Safety

There is a wide range of security problems, which corresponds to a number of different static analysis algorithms designed to identify them. For example, methods aimed at finding information flow vulnerabilities (No. 1 , 3 and 7of the OWASP Top 10 Top Ten Critical Web Application Security Threats) are not always good at detecting memory security issues (SANS 25 Issue #1). This means that multiple tools are recommended, even if you are primarily concerned with security. The Infer tool mentioned above helps detect information flow vulnerabilities such as command injection attacks or failed attempts to encrypt data at rest. Setting Infer to display information about your application and its infrastructure can detect more errors and improve signal-to-noise ratio. FindSecBugs open source tooldetects configuration issues, the use of poorly secured cryptography, and issues with injecting commands for a specific framework. It works out of the box - no additional settings are needed.

Style

Another good practice is to encourage team members to write code in a consistent style. It's not as important to choose a particular style as it is to ensure that developers adhere to it. An example is style guides.from Airbnb. There are two good reasons to automate style violation detection with static analysis. First, automation helps maintain the integrity of your code. Secondly, if the developer can make a mistake, then the tool will never allow this - it will always point out style violations. No one wants to be a code reviewer who points out problems with spaces or variable names to others. It's better to let the tools take responsibility for this kind of meticulousness so that team members can focus on improving the architecture and other high-level aspects of code quality.

interconnectedness

With so many tools needed to cover many different types of bugs, integrating these tools into DevOps processes is essential. The most important thing here is to set the right goal for the development process. For example, code reviews, since the platform is shared by multiple developers (unlike IDEs, which tend to be less cohesive) and often centrally managed. If you want to expand the use of static analysis, start with simple tools - FindSecBugs and PMD , which are geared towards finding problems with security and code style. Infer and ErrorProneare a little more difficult to work with because they require integration into the build system, but they provide deeper analysis. Considering how they increase productivity and confidence, the time it takes to put these tools into work is definitely worth it.