jvm-security-pitfalls

JVM Security Pitfalls (Java, Kotlin — Spring, Quarkus)

Overview

On the JVM the dangerous code is often configuration: a matcher order, a missing @EnableMethodSecurity, a Jackson typing setting, an Actuator exposure list. Read config and annotation diffs with the same care as handler code.

1. Spring Security Configuration (CWE-285, CWE-863)

• requestMatchers(...) rules are evaluated in order; a broad permitAll() placed above a narrower hasRole("ADMIN") wins.
• A security matcher and the MVC mapping must cover the same paths — check trailing slashes, path variables and alternate mappings of the same controller.
• @PreAuthorize/@Secured/@RolesAllowed do nothing without method security enabled (@EnableMethodSecurity); a new annotated method in a module that never enables it is unprotected.
• csrf { disable() } / .csrf().disable() while sessions use cookies → CSRF on every state change.

// ❌ the admin rule is never reached for /api/admin/**
http.authorizeHttpRequests {
    it.requestMatchers("/api/**").permitAll()
    it.requestMatchers("/api/admin/**").hasRole("ADMIN")
}
// ✅ most specific first, deny by default
http.authorizeHttpRequests {
    it.requestMatchers("/api/admin/**").hasRole("ADMIN")
    it.requestMatchers("/api/public/**").permitAll()
    it.anyRequest().authenticated()
}

Quarkus: a resource method without @RolesAllowed/@Authenticated where its siblings have one; @PermitAll added; quarkus.http.auth.permission.<name>.policy=permit widened to a broader paths=; quarkus.security.jaxrs.deny-unannotated-endpoints turned off.

2. Queries (CWE-89)

// ❌ JPQL injection
em.createQuery("SELECT u FROM User u WHERE u.email = '" + email + "'", User.class);
// ✅
em.createQuery("SELECT u FROM User u WHERE u.email = :email", User.class).setParameter("email", email);

Also: createNativeQuery with concatenation; JdbcTemplate.query("… " + x); @Query built with string concatenation in a custom repository; Spring Data JpaSort.unsafe(userInput) (plain Sort.by validates property names — unsafe does not); Panache find("name = '" + n + "'") instead of find("name", n) or find("name = ?1", n).