Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
0
votes
0answers
99 views

JSP shell in the image on Tomcat

I have the server running Tomcat/7.0.52 under Ubuntu. I'm trying to create an image with JSP shell. I wrote the shell like this: <%@ page import="java.io.*" %> <%@ page import="java.util.*" ...
1
vote
0answers
21 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += "net.sourceforge....
-1
votes
1answer
41 views

Security issues for a Java program that is a consumer of streaming radio

Are there any security issues I should be aware of when opening a Socket connection with the url/port of a streaming radio station? I have written some code to do this (no web stuff, just some Swing/...
1
vote
0answers
110 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
1
vote
2answers
95 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
-1
votes
1answer
124 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
3
votes
2answers
132 views

Is email sent form a Java web-app over a HTTPS connection encrypted?

I'm working on a Java web-application which runs on a HTTPS connection. This application sends emails to its users. I want to protect those emails from man-in-the-middle attacks and other potential ...
4
votes
2answers
3k views

Is it safe to enable SSLv2 ClientHello support?

In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello ...
3
votes
1answer
7k views

Encrypting data within SQLite database in Java - How to store key?

So, a bit of context before I start may be handy. I am developing a Java desktop application which will use an SQLite database to store/process data. The application will utilize authentication to ...
4
votes
1answer
52 views

Is there a PRNG in Java with a period of at least 256 bits?

From what I can tell, Sun JRE/JDK's are limited to only providing 128-bit strong cryptography without downloading an unlimited strength jurisdiction policy files. My question is, if I install theses ...
5
votes
4answers
533 views

Untrusted signature on java app for downloading youtube, harmful?

If you visit most of the "online youtube download" pages, you will get this message: Why all these sites come up with this message? Is it a worm, or just an unharmfull app?
9
votes
3answers
1k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
4
votes
1answer
144 views

How secure is my software for file encryption with AES-256?

I'm working on a project to build software for file encryption with AES in Java, it's operation is quite simple, but I was wondering if it is really safe. The program prompts the user for a ...
0
votes
1answer
430 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think ...
0
votes
1answer
90 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
1
vote
2answers
131 views

How to prevent reflected XSS with the Java Struts Framework? [closed]

I have an application that executes under Jboss server. I have an Apache server in front. My application contains a security vulnerability (XSS Cross-site scripting). I wanted to know that I had to ...
0
votes
0answers
12 views

Java card 3 connected edition availability

Why I am unable to find any Java card 3 connected edition development kit with smart cards? Does it mean that the connected edition are not manufactured by any company currently? The idea of ...
0
votes
0answers
91 views

OAUTH 2.0 Authorization Code flow and API key in Authorization header

We are creating Spring Boot REST services that registered third parties can use. We provided the third parties with a unique API key in JWT format, containing authorizations for that party to the ...
8
votes
1answer
418 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in ...
4
votes
0answers
1k views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
0
votes
1answer
198 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
17
votes
5answers
5k views

Java SecureRandom doesn't block? How?

I know from experience that reading from /dev/random blocks when the Linux kernel entropy pool runs out of entropy. Also, I've seen many articles and blog entries stating that when running on Linux, ...
1
vote
2answers
2k views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g....
0
votes
1answer
119 views

Securing Java REST Api for Saas usecase

I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring). I had a look at ...
3
votes
0answers
232 views

Security for Hospital IT

I'm developing a program in Java intended to be utilized in a hospital. The system uses RMI internally between workstations and the server program. The program would be installed on the hospital's ...
2
votes
2answers
277 views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I ...
5
votes
2answers
1k views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
36
votes
8answers
4k views

Should I worry about remote timing attacks on string comparison? [duplicate]

Say we have a Java web application which uses a shared secret to verify the identity of the client. The secret is stored on the server, and the client transmits the secret over SSL where it is checked:...
0
votes
0answers
36 views

JAAS Authorization with OSGi

I have a custom permission called SomePermission which extends the BasicPermission class. Also I have following entry in the policy file. grant principal org.sample.jaas.pincipal.SomePrincipal "admin"...
4
votes
4answers
939 views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With HTTPS,...
3
votes
2answers
296 views

SSL Newbie : Does https client also need a certificate?

I am calling an https url through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words do I need my own certificate or is the ...
1
vote
0answers
40 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication (2-...
4
votes
2answers
107 views

Can you ever get partially decrypted data from a decryption algorithm?

I'm decrypting some data using Java and Apache's most recent WSS4J library with 128-bit AES decryption. I setup the the cipher which appears to be correct with the right padding, decryption algorithm,...
0
votes
1answer
75 views

ReCaptcha Placement

I wish to use google's new version 2.0 reCaptcha on my website. My website displays some users' (public) information to other registered users. Where is the best place to place the reCaptcha? 1) On ...
0
votes
0answers
57 views

Apache SSL proxy or Jetty with SSL via keystore to app?

Our team is debating two deployment methods for a RESTful web application. Run the app under http with an embedded Jetty server, but fronted by Apache - Apache would handle the SSL/TLS. Install our ...
0
votes
2answers
2k views

What is the best way to encrypt a json object in Java?

I have a Json array JsonArray people; which holds JSON objects representing people. Currently I am saving them as plaintext in a json file. try { OutputStream out = new ...
2
votes
1answer
203 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
3
votes
2answers
458 views

Secure way to store application settings

What is a proper or, if possible to tell, the best way to store configuration in matters of security? So far I can tell that a database with very restricted access is a good way, but please let's ...
3
votes
1answer
54 views

What was the first version of Android to use OpenSSL (and what version was it)? What was used prior?

Android 1.6 source is the earliest I can find that references openssl (i.e., has OPENSSL_VERSION[_TEXT] defined The script I ran to get these versions was: $ git clone https://android.googlesource....
1
vote
3answers
149 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
2
votes
4answers
3k views

Can CVE-2015-4852 be exploited against WebLogic servers after a load balancer?

I have Java applications served by Oracle WebLogic servers that are after a load balancer. The WebLogic t3 protocol (vulnerable) is not tunneled to the WebLogic servers, only the HTTP requests. In ...
1
vote
2answers
581 views

How come PBEWITHSHA256AND128BITAES-CBC-BC violates the 128bit key limit?

In my Java application (which use StandardPBEStringEncryptor by jasypt), when i use the PBEWITHSHA256AND128BITAES-CBC-BC algorithm instead of something weaker such as PBEWithMD5AndDES, i get an ...
2
votes
0answers
50 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
2
votes
2answers
105 views

Java code signing vs. sandboxing

I'm trying to understand the rationale behind Java Applet development these past few years. Back in the old days, most Applets were unsigned, and the code for these was run in a sandbox where barring ...
1
vote
1answer
117 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
1
vote
0answers
126 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
2
votes
1answer
151 views

How to revoke certificates, or generate CRL files with Keytool

I didn't find how to use java keytool to revoke certificates or generate CRL files. Is it possible to do that with keytool? If no, how to do it with openssl ?
3
votes
1answer
1k views

How to resolve Path Manipulation error given by fortify?

I need to read the properties file kept in user home folder. PropertyFile=System.getProperty("user.home")+System.getProperty("file.separator")+"sample.properties"; Fortify is giving path ...
2
votes
1answer
31 views

SSL with both local client and server

I'm not sure whether this topic belongs in Cryptography, Programming or StackOverFlow so please forgive me if I don't add a useful question to this site. I want to give both server and client ...