Questions tagged [secure-coding]

The tag has no usage guidance.

16 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
117 views

Taint analysis in a functional language

I recently read a paper titling "All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)" by Dr. EJ Schwartz. In the paper, he ...
2
votes
0answers
251 views

How to use JAXB Custom Mapping to whitelist classes instantiatable over XML

Known vulnerabilities associated with JAXB unmarshalling are: XXE billion laughs RCE which are due to deserialization of untrusted data and the resolution of external references. I'm aware of the ...
2
votes
0answers
32 views

How to secure/ensure a call from Excel AddIn to IIS Backend?

I need to develop an Excel AddIn which should gather a local information and send it to a backend system which is installed on an IIS (https). In general i want to use https but how can i ensure that ...
1
vote
0answers
31 views

HSM: How multiple users are supported (using SAM)?

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
1
vote
0answers
58 views

Would my Java web application be vulnerable if I use a netty version that is vulnerable to CVE-2019-20444 and CVE-2019-20445?

These has been fixed in later versions of Netty ... but what is the risk of using an older (can't upgrade now) version that is vulnerable to to CVE-2019-20444 and CVE-2019-20445 ... is there really a ...
1
vote
0answers
66 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
1
vote
0answers
40 views

Calling Powershell script from external program passing an argument

I have an external program which calls a PowerShell script with a random secret identifier as a single argument. The PowerShell script needs to return the same random secret id when it calls the REST ...
1
vote
1answer
309 views

Secure coding standards and guidelines

I was trying to research on available secure coding guidelines of server-side and client-side languages. There are online documentation from Oracle for Java, Microsoft for asp.net, and w3 for html5 ...
1
vote
0answers
33 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
0answers
252 views

Instant Messaging End-to-End

I plan to create an application for secure instant messaging, now I don't know whether or not I want to implement the encryption by myself. This project is also mainly for educational purpose so I ...
0
votes
0answers
30 views

Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority

The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
0
votes
0answers
69 views

How is Hopwood's Java interface attack related to least common mechanism principle?

I'm trying to understand LCM and how David Hopwood's discovery is a noteworthy example of it. This site contains two important things. First, it identifies Hopwood's interface attack (1996) as an ...
0
votes
0answers
267 views

What is the risk of allowing user input in Python's 're' module

Some context I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter ...
0
votes
0answers
39 views

Bind application user roles to JWT is good

I need implement service oriented application. so i hope to use micro services for my back end function and react for fronted end development. for session management i hope to use JWT tokens. with ...
0
votes
0answers
1k views

Store a symmetric key in Java Keystore

It would be great if someone can let me know how exactly we can store a symmetric key in a Java Keystore. It is common to use store key pairs in Keystores. But I need to store a symmetric key and ...
0
votes
0answers
116 views

Why the column fields doesn't show up on injection of column names?

I'm practicing SQL injection. I've been able to get the column names and table names on a test environment. query 1. On executing below query, I see adminId, adminUsername, adminPassword http://...