secure-dev-java

Secure Java Development

These rules apply to all Java code in the repository (including Spring, Jakarta EE, and standalone apps) and aim to prevent common security risks through disciplined use of input validation, safe APIs, and secure coding patterns.

All violations must include a clear explanation of which rule was triggered and why, to help developers understand and fix the issue effectively.
Generated code must not violate these rules. If a rule is violated, a comment must be added explaining the issue and suggesting a correction.

1. Avoid Insecure Deserialization

• Rule: Never deserialize untrusted data using ObjectInputStream, readObject(), or similar APIs. Use safe serialization formats (e.g., JSON, protobuf) and validate all input before deserialization.
• Unsafe:

  ObjectInputStream ois = new ObjectInputStream(inputStream);
  Object obj = ois.readObject(); // Untrusted input ➜ RCE risk
  

• Safe:

  // Use a safe format and strict schema validation
  MyObject obj = objectMapper.readValue(jsonInput, MyObject.class);
  

2. Use Parameterized Queries for Database Access

• Rule: Never build SQL queries by concatenating user input. Use PreparedStatement or ORM parameterization.

3. Always Use Prepared Statements for SQL

• Rule: Always use PreparedStatement for SQL queries, never concatenate or interpolate user input into SQL strings. Prepared statements ensure user input is treated as data, not code, and are the most effective way to prevent SQL injection.
• Unsafe:

  String query = "SELECT * FROM users WHERE username = '" + userInput + "'";
  Statement stmt = conn.createStatement();
  ResultSet rs = stmt.executeQuery(query);
  

• Safe:

  String query = "SELECT * FROM users WHERE username = ?";
  PreparedStatement pstmt = conn.prepareStatement(query);
  pstmt.setString(1, userInput);
  ResultSet rs = pstmt.executeQuery();
  

4. Prevent Command Injection

• Rule: Never pass user input directly to Runtime.exec(), ProcessBuilder, or similar APIs. Use allow-lists, parameterization, and safe wrappers. Avoid shell invocation unless absolutely necessary.
• Unsafe:

  Runtime.getRuntime().exec("ls " + userInput); // Command injection risk
  

• Safe:

  // Use ProcessBuilder with static arguments or validated input
  ProcessBuilder pb = new ProcessBuilder("ls", validatedArg);
  pb.start();