New answers tagged

0

Ill certainly look into API keys and see if thats a solution thank you!


1

Your question isn't very clear, but answering one possibility: The KeyStore API abstractly and the JKS format concretely has two kinds of entries relevant to SSL/TLS: the privateKey entry for a server contains the privatekey and the cert chain (leaf and intermediate(s) and usually root) all under one alias; trustedCert entries (if any) contain certs for ...


1

in a keystore/trustore you can have more keys/certificates and every key has an alias. If you have to configure the SSL in a server, usually you configure the keystore, the keystore-password, the key password and the alias. Basically with the alias you refer which key you intend to use. example with jboss wildfly 8 < security-realm ...


0

Right now I see 2 problems with this code, Depending on the context. The fact that the filename ends with .pdf does not mean it is a PDF file. Which could lead to all kinds of trouble. Malicious code can be hidden in macros of PDF files. But like I said, it all depends on the context.


1

Apart from path traversal attacks this code could be vulnerable to Null-Byte injection. For more information read this. Update: As Maarten Bodewes pointed out, this has been fixed since Java 1.7.0_40. I remember this being a vulnerability in 1.6 though. Anyway when you take a look at the source code for the File class you find that the isInvalid() method ...


0

Guava's InternetDomainName class would probably help here. IllegalArgumentException: Not a valid domain name: 'file:///foo' IllegalArgumentException: Not a valid domain name: 'gopher://kyourself' IllegalArgumentException: Not a valid domain name: 'http://localhost/bad.jpg' IllegalArgumentException: Not a valid domain name: 'http://a.b/bad.jpg'


2

JDBC is a Java API. It uses JDBC database drivers to actually communicate with database servers. These drivers may or may not support TLS. The PostgreSQL JDBC driver supports TLS: https://jdbc.postgresql.org/documentation/94/ssl.html So, it would connect to the database server using TLS, then send the username and password to authenticate. You would not ...


2

Taking a look at the specific source code piece(GoogleDrive.java) that handles credential file creation/initialization, I found this: Line 449: /** Directory to store user credentials. */ private final java.io.File DATA_STORE_DIR; Line 473: public GoogleDrive(Properties configuration) { DATA_STORE_DIR = new java.io.File("data/google/" + ...


1

This has been documented in the past, where researchers discovered that some of the Tomcat examples left on a default install were vulnerable to exploits. In "vulnerability assessment/auditing" tools/programs, many will flag this directory as being at a high risk due to these applications being left on a system after an installation. A best practice approach ...


0

The reasoning might have been that ResultSet.getString and RestulSet.getObject should return a valid result no matter what the underlying value is for the column you specify. So if there was an SQLi attack and column 1 is usually a string but is now some secret number you'll get still a valid result and thus leak information about that result. Whereas ...



Top 50 recent answers are included