Index

Symbols

& (AND)

bitwise vs. logical operators, 225–228

precedence of operation, 186–187

&& (AND)

assignments in conditional expressions, 176–177

bitwise vs. logical operators, 225–228

| (OR)

bitwise vs. logical operators, 225–228

numeric promotion behavior, 110

precedence of operation, 186

|| (OR)

assignments in conditional expressions, 176

bitwise vs. logical operators, 225–228

% (remainder operator), 220–222

() (parentheses), 186–188

*/ (asterisk backslash), 196–197

' (single quote), 27

" (double quotes)

output sanitization, 19

preventing XPath injection, 27

/ (backslash), 27

/* (backslash asterisk), 196–197

// (double backslash), 196

; (semicolon), 180–181

?: (conditional operator), 153, 176

!= (equality operator), 222

^ (caret), 186

{} (braces), 178–180

(PI), 139–140

<> (angle braces)

output sanitization, 19

preventing XPath injection, 27

<< (comparison operators), 186

= (assignment operator), 176–178

== (equality operator), 70, 222–225

>> (comparison operators), 186

A

abstract classes, 126–127

Abstract object equality, 222–225

Abstract Window Toolkit (AWT), 95

Access control

avoid granting excess privileges, 50–53

calling security-sensitive methods with validated arguments, 11–13

java.util.Date, 33

minimize accessibility of classes and their members, 84–89

AccessControlContext

avoid granting excess privileges, 52–53

preventing code injection, 22

AccessController

doPrivileged(), 51

SecurityManager, 68

Advanced Encryption Standard (AES), 36–37

allowedType, 14

Always provide feedback about resulting value of method, 96–99

AND (&)

bitwise vs. logical operators, 225–228

precedence of operation, 186–187

AND (&&)

assignments in conditional expressions, 176–177

bitwise vs. logical operators, 225–228

Android guidelines applicability, 245–246

Angle braces (<>)

output sanitization, 19

preventing XPath injection, 27

Annotations

document thread-safety, 89–96

scope of @SuppressWarnings, 82–84

Apache Geronimo and Tomcat vulnerability, 130

API

careful interface design, 125–128

minimize accessibility of classes and their members, 85, 89

prefer using iterators over enumerations, 159–161

providing feedback about resulting method values, 96–99

scope of guidelines, xv

SecurityManager, 70–71

writeUnshared(), 239

Applet security managers, 68

appletviewer, 70

Arbitrary code

output sanitization, 16–19

preventing upload, 13–16

Arguments, validated, 11–13

Arithmetic operations

floating-point operations, 191–194

precedence of operation, 186–188

ArrayIndexOutOfBoundsException, 147

ArrayList

minimize scope of @SuppressWarnings, 83–84

remove short-lived objects from long-lived container objects, 163–164

Arrays

return empty instead of null, 143–146

safe publication guarantee and volatile, 210–211

ASCII character set, 168

assert, 151–153

Assignment operators (=), 176–178

Assignments, 175–178

Assumptions. See Programmer misconceptions

Asterisk backslash (*/), 196–197

AtomicIntegerArray, 211

Atomicity

defined, 249

preserving compound operation, 213

AtomicReferenceArray, 33–34

Attributes, 99–106

Audience, xvii

Authentication

preventing LDAP injection, 29–31

preventing XPath injection, 24

AutoDetectParser, 15–16

Avoid ambiguous or confusing uses of overloading, 205–208

Avoid ambiguous overloading of variable arity methods, 171–173

Avoid cyclic dependencies between packages, 118–121

Avoid granting excess privileges, 50–53

Avoid in-band error indicators, 173–175

Avoid inadvertent wrapping of loop counters, 183–186

AWT (Abstract Window Toolkit), 95

B

Backslash (/), 27

Backslash asterisk (/*), 196–197

Backward compatibility of SecurityManager, 68

BasicPermission, 65–67

Be aware of numeric promotion behavior, 108–112

Be careful using visually misleading identifiers and literals, 167–171

Bitwise vs. logical operators, 225–228

Bloch, Joshua

overloading methods, 207

on thread-safety annotations, 92

Block comments, 196–198

Booleans

feedback about resulting method values, 97

meaningful symbolic constants to represent, 138

type use for second and third operands in conditional expressions, 153–154

Braces ({}), 178–180

break statement, 181–183

BufferedReader

file identification, 100

limiting lifetime of sensitive data, 2–4

Buffers

helping garbage collector, 243–244

limiting lifetime of sensitive data, 2–5

short-lived infrequently used objects and, 162–163

Bugs, xv–xvi

byte array, 40–41

Bytecode verifier, 1

C

Callback methods, 72–77

CallBackAction, 72–77

Canonicalization

custom, 225

defined, 213

Carefully design interfaces before releasing them, 125–128

Caret (^), 186

case, 181–183

catch, 146–147

The CERT^® Oracle^® Secure Coding Standard for Java™ (Long)

CERT Vulnerability Note VU#636312, 60–62

defined, xiv

exception NUM12-EX0 of NUM12-J, 155

feedback about resulting method values, 96

graceful recovery from system errors, 124

in-band error indicators, 173

premature optimization, 140–141

preventing code injection, 20

random number generation, 42

reduced security checks, 58

safe publication, 94

try-with-resources statement, 148

unchecked warnings, 82

wrapping sensitive mutable classes, 10

changePassword(), 54–55

Characters

to exclude from whitelists, 28

how escape characters are interpreted when strings are loaded, 228–231

meaningful symbolic constants to represent, 138

preventing XPath injection, 27

type use for second and third operands in conditional expressions, 153–154

visually misleading identifiers and literals, 167–168

checkMetaData(), 15

checkPackageAccess(), 62

checkPassword(), 41

Class loaders, 56–58, 60–62

Class variables, 249

Classes

minimizing accessibility of, 84–89

minimizing scope of @SuppressWarnings, 82–83

security, 1

SecurityManager, 67–72

unmodifiable wrappers for sensitive mutable, 9–11

Class.forName(), 61–64

Client-side storage of sensitive information, 5–9

clone()

ensuring it calls super.clone(), 194–196

final variable and, 236–237

untrusted method parameters, 31–34

Closeable resources, 148–151

Code

detect and remove superfluous, 198–202

garbage-collection-friendly, 128–130

injection, 20–23

Java guidelines and standards, xiv–xv

source, 50–51

style, xvii

understandability. See Program understandability

CodeSource, 50–51

Collections

iterators vs. enumerations, 159–161

returning empty instead of null, 143–146

unmodifiable wrappers for sensitive mutable classes, 9

Command-line security manager installation, 69–70

Comment consistency and readability, 196–198

Comparison operations

abstract object equality vs. reference equality, 222–225

cryptographic keys, 34–35

terminating loops, 185

Comparison operators (>>), 186

Comparison operators (<<), 186

Compile-time checking of variable arity parameter types, 112–115

Compound operators, 109, 111–112

Concurrency annotations, 90

Condition predicate

defined, 249

wait-notify protocols, 95

Conditional expressions

assignments in, 175–178

bitwise vs. logical operators, 225–228

same type for second and third operands in, 153–157

Conditional operator (?:), 153, 176

Constants

application of public final, 115–118

encoding relationships in definitions, 142–143

representing literal values in program logic, 138–142

Constructor overloading, 205–206

Controlling expression, 95, 175–178, 249

Controversial guidelines, xvii

Convert integers to floating point for floating-point operations, 191–194

Cookies, 5–9

Copying

providing functionality with clone(), 236–238

untrusted method parameter, 31–34

counter(), 81–82

Create secure sandbox using security manager, 67–72

createNewFile(), 189–190

createSecurityManager, 68

Creative Commons Attribution License, 90

Cross-Site Scripting (XSS) attacks

output sanitization, 16–19

storing unencrypted sensitive information, 5–6

Cryptographic algorithms, 36–37

Cryptographic hash functions, 37–38

Cryptographic key comparison, 34–35

Custom security manager, 71

Custom security permissions, 64–67

Custom security policies, 68

Cyclic dependencies, 118–121

D

DAG (directed acyclic graph), 118

Data Encryption Standard (DES), 36

Data races. See also Race conditions

defined, 249

preventing, 96

Data, sensitive. See Sensitive data

DataElement, 164–165

DateFormat, 214–215

Dead code, 198–202

Deadlock, 249

Decimal values, 170

Declarations, 134–137

Default exception handler, 65–67

default label

defined, 181–183

logical completeness, 203

Default security manager, 69–71

Defensive programming

always provide feedback about resulting value of method, 96–99

application of public final to constants whose value might change, 115–118

avoid cyclic dependencies between packages, 118–121

be aware of numeric promotion behavior, 108–112

carefully design interfaces before releasing them, 125–128

do not attach significance to ordinal associated with enum, 106–108

document thread-safety and use annotations where applicable, 89–96

enable compile-time type checking of variable arity parameter types, 112–115

identify files using multiple file attributes, 99–106

minimize accessibility of classes and their members, 84–89

minimize scope of @SuppressWarnings annotation, 82–84

minimize scope of variables, 80–82

overview, 79

prefer user-defined exceptions over more general exception types, 121–123

try to gracefully recover from system errors, 123–125

write garbage-collection-friendly code, 128–130

Define custom security permissions for fine-grained security, 64–67

Delegating method implementation, 126

delete(), 99

Delimiters, 196–197

Denial-of-service (DoS)

garbage-collection-friendly code, 128–129

graceful recovery from system errors, 124–125

inadvertent wrapping of loop counters, 186

returning empty array or collection instead of null value, 143, 146

verifying absence of runtime errors, 152

Dependencies, cyclic, 118–121

DES (Data Encryption Standard), 36

Design

intent, 89

interface, 125–128

Detect and remove superfluous code and values, 198–202

Direct buffers, 162–163

Directed acyclic graph (DAG), 118

Directories, 99

-disableassertions (-da), 151

display(), 232–233

displayBooleans(), 171–172

Division, 191–193

do ... while, 175

Document thread-safety and use annotations where applicable, 89–96

Documentation

consistency and readability, 196–198

thread-safety and use annotations where applicable, 89–96

doPrivileged()

avoid granting excess privileges, 52

calling security-sensitive methods with validated arguments, 12

do not expose methods that use reduced-security checks to untrusted code, 58–59

do not let untrusted code misuse privileges of callback methods, 75–77

minimize privileged code, 54–55

preventing code injection, 22

DoS (denial-of-service). See Denial-of-service (DoS)

doSomething()

synchronization semantics, 218–219

user-defined exceptions, 122

double

floating-point operations, 192–193

numeric promotion behavior, 108–111

Double backslash (//), 196

Double quotes (")

output sanitization, 19

preventing XPath injection, 27

E

E, 140

Electronic Frontier Foundation’s (EFF) Deep Crack, 36

Empty arrays and collections, 143–144

Enable compile-time type checking of variable arity parameter types, 112–115

Encoding

proper output, 16–20

relationships in constant definitions, 142–143

Encryption

storing passwords using hash functions, 37–42

using secure algorithms, 36–37

End-of-line comments, 196–198

Ensure security-sensitive methods are called with validated arguments, 11–13

Ensure that clone() method calls super.clone(), 194–196

Ensure that SecureRandom is properly seeded, 42–43

enum

do not attach significance to ordinal associated with an, 106–108

prefer using iterators over, 159–161

thread-safety annotations, 92

Equality operator (==), 70, 222–225

Equality operator (!=), 222

equals()

abstract object equality vs. reference equality, 222–225

comparing cryptographic keys, 34–35

do not rely on methods that can be overridden by untrusted code, 44–45

Errors

avoid in-band indicators, 173–175

graceful recovery from system, 123–125

providing feedback about resulting method values, 96–99

reliability, xiii

verifying absence of runtime, 151–153

Escape characters, 228–231

Escaping output, 16–20

evaluate(), 24

ExceptionReporterPermission, 65–67

Exceptions

assumptions about file creation, 189–190

avoid in-band error indicators, 173

graceful recovery from system errors, 123–125

providing feedback about resulting method values, 96–99

try-with-resources statement, 148–151

use for exceptional conditions, 146–148

user-defined vs. general types, 121–123

F

false, 97

Federally funded research and development center (FFRDC), xvii

Feedback, 96–99

Field shadowing, 132–133

“File not found”, 122

FileChannel.size(), 105

fileKey, 103–104

filename, 100

Files

assumptions about creation, 189–190

do not serialize direct handles to system resources, 157–158

identifying using multiple file attributes, 99–106

preventing arbitrary upload, 13–16

Files.isSameFile(), 101–102

filter, 30–31

final

application of public final to constants, 115–118

immutability of reference vs. referenced object, 234–238

final class

do not rely on methods that can be overridden by untrusted code, 47, 49

minimize accessibility of classes and their members, 86–87

Finalizers, 243

finally block

graceful recovery from system errors, 123–124

try-with-resources statement and, 149

findClass(), 61–62

Finish every set of statements associated with case label with break statement, 181–183

Fixes, 125

Flashback, 33

float, 108–111

Floating-point numbers

convert integers to, 191–194

meaningful symbolic constants to represent, 138

for

assignments in conditional expressions, 175

declaring variables separately, 136–137

do not place semicolon immediately following, 180–181

inadvertent wrapping of loop counters, 183–186

minimizing scope of variables, 80–82

use braces for, 178–180

use exceptions only for exceptional conditions, 147

format, 214

G

Garbage collector (GC)

garbage collection–friendly code, 128–130

remove short-lived objects from long-lived container objects, 163–164

setting local reference variables to null, 243–244

short-lived, infrequently used objects, 162

Generational garbage collection, 129

Generic type parameters, 112–115

getArray(), 9–11

getConnection(), 59–60

getData(), 206–208

getFirst(), 210–211

getState(), 218–220

getTime(), 33

getVersion(), 116–117

Goetz, Brian

documenting locking policies, 92

documenting wait-notify protocols, 95

Granting privileges, 50–53

@GuardedBy, 91, 92–93

H

Happens-before relationship, 211–212, 252

Hash functions, 37–42

hashCode()

abstract object equality vs. reference equality, 222

methods that can be overridden by untrusted code, 44–46, 48–49

hashKey, 221–222

Heap memory, 250

heavilyUsedBuffer, 162

Hide, 132, 250

HTML files, 13–16

HTML renderers, 16

HttpSession, 7–8

I

Identifiers

be careful using visually misleading, 167–171

do not shadow or obscure in subscopes, 132–134

using multiple file attributes, 99–106

IdentityHashMap, 46–47

if

assignments in conditional expressions, 175–177

bitwise vs. logical operators, 227

do not place semicolon immediately following, 180–181

logical completeness, 202

use braces for, 178–180

Immutability

confusing reference with referenced object, 234–239

defined, 252

short-lived objects, 129

thread-safety annotations, 91–92

unmodifiable wrappers for sensitive mutable classes, 9–10

@Immutable, 91

imod(), 221–222

In-band error indicators, 173–175

Index variable, 80–82

Indirect buffers, 162–163

Initialization, 135

Injection attacks

Java security, 1–2

prevent code, 20–23

prevent LDAP, 27–31

prevent XPath, 23–27

Input

normalization, 30–31

verification, 152

Insecure cryptographic algorithms, 36–37

Installing security manager, 69–72

Integers

convert for floating-point operations, 191–194

inadvertent wrapping of loop counters, 184–186

meaningful symbolic constants to represent, 138

numeric promotion behavior, 108–112

Integral operands, 220–222

Intent of programmer

Java guidelines and, xiv

visually misleading identifiers and literals, 168

Interfaces

careful design, 125–128

cyclic dependencies between packages, 119–121

Interned strings, 223–225

IsSameFile(), 101–102

Iterators, 159–161

-J Flag, 70

J

Java Concurrency in Practice (Goetz), 90

Java Language Specification (JLS)

be careful using visually misleading identifiers and literals, 167–168

escape characters, 229

final fields and constants, 116

final variables, 234

numeric promotion behavior, 108

on obscuring, 132

ordinal associated with enum, 106

remainder operators, 220–221

rules for determining result type of conditional expression, 153–154

scope of guidelines, xv

security, 1

sleep() and yield(), 215

String.intern(), 224

types of exceptions, 123

volatile fields, 209

Java Naming and Directory Interface (JNDI) metacharacters, 27–28

Java SE 7 Platform, xv, xvi

Java Virtual Machine (JVM)

graceful recovery from system errors, 123

password storage, 40

reduced security checks, 56

scope of guidelines, xv

security, 1

String.intern(), 224

synchronization semantics, 219

java.io, 189

java.io.File, 99

java.nio, 162

java.nio.file.Path, 99

java.policy, 69–70

JavaScript code injection, 20–23

java.util.Date, 33

java.util.regex.Pattern, 228

javax, xvi, 20

JCIP (Java Concurrency in Practice) annotations, 90

JITs (just-in-time compilers), 243

JLS (Java Language Specification), see Java Language Specification (JLS)

JNDI (Java Naming and Directory Interface) metacharacters, 27–28

JSure tool, 90

Just-in-time compilers (JITs), 243

JVM (Java Virtual Machine). See Java Virtual Machine (JVM)

K

Key classes, 34–35

L

Large objects, 129

Latin-1 characters, 168

LayoutManager, 47–49

LDAP (Lightweight Directory Access Protocol) injection, 27–31

Libraries, xv–xvi

LicenseManager, 44–47

Lifetime of sensitive data, 2–5

Lightweight Directory Access Protocol (LDAP) injection, 27–31

Limit lifetime of sensitive data, 2–5

List, 207, 232–233

Literal values

be careful using visually misleading, 167–171

use meaningful symbolic constants to represent, 138–142

Liveness, 243, 250

Loading libraries, 65–67

Locking policies, 92–94

Logical completeness, 202–204

Logical operators, 225–228

Logs, 123–124

long, 108–109

Long-lived container objects, 163–165

Loops

declaring variables separately, 136–137

inadvertent wrapping of loop counters, 183–186

logical completeness, 203–204

M

Maintenance, 118

MaliciousCallBack, 75

Map, 212

Mathematical expressions

floating-point operations, 191–194

precedence of operation, 186–188

MD5 (Message-Digest Algorithm), 38

Memory

garbage-collection-friendly code, 128–130

limiting lifetime of sensitive data, 2–4

OutOfMemoryError, 125

remove short-lived objects from long-lived container objects, 163–165

Memory model

defined, 250–251

volatile fields, 209

Message-Digest Algorithm (MD5), 38

MessageDigest, 38–41

Messages, 121–122

Metacharacters

preventing LDAP injection, 27–28

preventing XPath injection, 27

Methods

accessibility of classes and their members, 84–89

ambiguous overloading of variable arity, 171–173

calling security-sensitive with validated arguments, 11–13

copying untrusted parameters, 31–34

ensuring that clone() calls super.clone(), 194–196

exposure to untrusted code, 56–64

feedback about resulting value of, 96–99

file identification and, 99

in-band error indicators, 173

misuse of overloaded to differentiate between, 231–233

overloading, 206–208

overridden by untrusted code, 44–50

privileges of callback, 72–77

returning empty array or collection instead of null, 143–146

scope of @SuppressWarnings, 82

synchronization, 213–214

varargs, 112

writeUnshared() and readUnshared(), 239–243

Minimize accessibility of classes and their members, 84–89

Minimize privileged code, 54–55

Minimize scope of @SuppressWarnings annotation, 82–84

Minimize scope of variables, 80–82

Misconceptions. See Programmer misconceptions

Misleading characters, 168

Model-view-controller (MVC), 17

Modularize interfaces, 127

move(), 99

Multiplication

converting integers for floating-point operations, 191–192

numeric promotion behavior, 109–110

Mutable classes

final variable and, 234–235

provide sensitive with unmodifiable wrappers, 9–11

Mutable objects

applying static final, 115

construction annotations, 94–95

safe publication guarantee and volatile, 210, 212–215

N

Never confuse immutability of reference with that of referenced object, 234–239

NIO (new I/O) buffer, 4–5

NodeNotFoundException, 98

Nonnative libraries, 59

Normalization, 30–31, 251

Notation, 136–137

Notify protocols, 95–96

NOTREACHED, 196–197

@NotThreadSafe, 92

Null Object pattern, 164–165

null values

avoid in-band error indicators, 173

calling security-sensitive methods with validated arguments, 11–13

do not attempt to help garbage collector, 243–244

providing feedback about resulting method values, 98–99

return empty array or collection instead of, 143–146

Number, 113–114

Numeric promotion behavior, 108–112

O

Object

compile-time type checking of variable arity parameter types, 112–113

declaring variables separately, 135–136

immutability, 252

Object.equals()

abstract object equality vs. reference equality, 222–225

comparing cryptographic keys, 34–35

methods that can be overridden by untrusted code, 44

Object.hashCode(), 44

Obscure, 132, 251

Octal values, 170

Operands

floating-point, 191–194

numeric promotion behavior, 108–112

parentheses for precedence of operation, 186–188

remainder operator results for integral, 220–222

type use for second and third in conditional expressions, 153–157

OR (|)

bitwise vs. logical operators, 225–228

numeric promotion behavior, 110

precedence of operation, 186

OR (||)

assignments in conditional expressions, 176

bitwise vs. logical operators, 225–228

ordinal(), 106–108

OutOfMemoryError, 125, 162

Output sanitization, 16–20

Overloading

avoid ambiguous or confusing uses of, 205–208

misuse of methods to differentiate between, 231–233

variable arity methods, 171–173

Override, 251

P

Package dependencies, 118–121

Package-private access, 84–89

Parameters

avoid ambiguous or confusing uses of overloading, 205–208

compile-time type checking of variable arity types, 112–115

do not use clone() to copy untrusted method, 31–34

preventing XPath injection, 26–27

Parentheses (()), 186–188

parse(), 214–215

Passwords

limiting lifetime of sensitive data, 3–4

minimize privileged code, 54–55

preventing XPath injection, 24–27

store using hash function, 37–42

Path, 99, 101

Pattern, 228–231

performActionOnFile(), 51–52

Performance

calling System.gc(), 130

reliability, 131

permgen, 224

Permissions. See also Privileges

assumptions about file creation, 189

avoid granting excess privileges, 50–53

define custom security for fine-grained security, 64–67

SecurityManager, 68

PI (), 139–140

Platforms

Android guidelines applicability, 245–246

scope of guidelines, xv

Point, 236–237

Policy files, 69–70

Precedence of operation, 186–188

Predefined constants, 140

Prefer user-defined exceptions over more general exception types, 121–123

Prefer using iterators over enumerations, 159–161

Premature optimization, 140–141

Prevent arbitrary file upload, 13–16

Prevent code injection, 20–23

Prevent LDAP injection, 27–31

Prevent XPath injection, 23–27

private classes

accessibility of classes and members, 84–89

final variable and, 237–238

private static, 116–117

Privileges

avoiding excess, 50–53

callback method, 72–77

calling security-sensitive methods, 11–13

minimizing privileged code, 54–55

preventing code injection, 22–23

processSingleString(), 146–147

Program understandability

assignments in conditional expressions, 175–178

avoid ambiguous or confusing uses of overloading, 205–208

avoid ambiguous overloading of variable arity methods, 171–173

avoid in-band error indicators, 173–175

avoid inadvertent wrapping of loop counters, 183–186

be careful using visually misleading identifiers and literals, 167–171

convert integers to floating point for floating-point operations, 191–194

detect and remove superfluous code and values, 198–202

do not make assumptions about file creation, 189–190

do not place semicolon immediately following if, for, or while condition, 180–181

ensure that clone() method calls super.clone(), 194–196

finish every set of statements associated with case label with break statement, 181–183

overview, 167

parentheses for precedence of operation, 186–188

strive for logical completeness, 202–204

use braces for body of if, for, or while statement, 178–180

use comments consistently and in readable fashion, 196–198

Programmatic SecurityManager installation, 70–71

Programmer intent, xiv

Programmer misconceptions

do not assume that declaring reference volatile guarantees safe publication of members of referenced object, 209–216

do not assume that remainder operator always returns nonnegative result for integral operands, 220–222

do not assume that sleep(), yield(), or getState() provide synchronization semantics, 216–220

do not attempt to help the garbage collector by setting local reference variables to null, 243–244

do not confuse abstract object equality with reference equality, 222–225

do not use overloaded methods to differentiate between runtime types, 231–233

never confuse immutability of reference with that of referenced object, 234–239

overview, 209

understand differences between bitwise and logical operators, 225–228

understand how escape characters are interpreted when strings are loaded, 228–231

use serialization methods writeUnshared() and readUnshared() with care, 239–243

Programming, defensive. See Defensive programming

Properly encode or escape output, 16–20

Properly encode relationships in constant definitions, 142–143

protected classes, 84–89

Protection domain, 51

Provide sensitive mutable classes with unmodifiable wrappers, 9–11

public classes, 86

public final, 115–118, 237–238

Publishing objects

defined, 251

safe publication guarantee, 209–216

R

Race conditions

assumptions about file creation, 189–190

defined, 251

preventing with annotation, 96

preventing with state testing, 97

Random number generation, 42–43

RandomAccessFile, 104

rarelyUsedBuffer, 162

Readability. See also Program understandability

comment consistency and readability, 196–198

defined, 167

meaningful symbolic constants, 141

readObject(), 239

readUnshared(), 239–243

Recovery, 123–125

References

abstract object equality vs. reference equality, 222–225

immutability vs. immutability of referenced object, 234–239

safe publication guarantee and volatile, 209–216

setting local variables to null, 243–244

Referents, 210

@Region, 91

@RegionLock, 91, 92–94

Registries, 42–43

Relationship encoding, 142–143

Releases

application of public final to constants whose value might change, 115–118

avoid cyclic dependencies between packages, 118

careful interface design, 125–128

Reliability

defined, xiii

do not declare more than one variable per declaration, 134–137

do not serialize direct handles to system resources, 157–158

do not shadow or obscure identifiers in subscopes, 132–134

do not use assertions to verify absence of runtime errors, 151–153

do not use direct buffers for short-lived, infrequently used objects, 162–163

overview, 131–132

prefer using iterators over enumerations, 159–161

properly encode relationships in constant definitions, 142–143

remove short-lived objects from long-lived container objects, 163–165

return empty array or collection instead of null value for methods that return array or collection, 143–146

use exceptions only for exceptional conditions, 146–148

use meaningful symbolic constants to represent literal values in program logic, 138–142

use same type for second and third operands in conditional expressions, 153–157

use try-with-resources statement to safely handle closeable resources, 148–151

Remainder operator (%), 220–222

Remember-me functionality, 5–9

Remove short-lived objects from long-lived container objects, 163–165

renameTo(), 99

Resources, 148–151

RestrictedAccessControlContext, 22

Return empty array or collection instead of null value for methods that return array or collection, 143–146

Reusability, 118

Robustness, 79

ROT13 cipher, 37

RSAPrivateCrtKey, 35

RSAPrivateKey, 35

run(), 49–50

Runtime errors, 151–153

Runtime types, 231–233

RuntimeException, 147

S

Safe publication guarantee, 209–216, 251

Safety, 251

Salt, 38

Sandbox, secure

create using security manager, 67–72

preventing code injection, 22–23

Sanitization

defined, 251

input, 30–31

output, 16–20

SCALe (Source Code Analysis Laboratory), xiv

Scherlis, William, 95

Scope

@SuppressWarnings annotation, 82–84

variable, 80–82

searchRecord(), 29

Secure Hash Algorithm (SHA), 38, 39–40

Secure sandbox

create using security manager, 67–72

preventing code injection, 22–23

SecureRandom, 42–43

Security

avoid granting excess privileges, 50–53

carefully design interfaces before releasing them, 125–126

create secure sandbox using security manager, 67–72

define custom security permissions for fine-grained security, 64–67

do not expose methods that use reduced-security checks to untrusted code, 56–64

do not let untrusted code misuse privileges of callback methods, 72–77

do not rely on methods that can be overridden by untrusted code, 44–50

do not store unencrypted sensitive information on client side, 5–9

do not use clone() to copy untrusted method parameters, 31–34

do not use insecure or weak cryptographic algorithms, 36–37

do not use Object.equals() to compare cryptographic keys, 34–35

ensure security-sensitive methods are called with validated arguments, 11–13

ensure that SecureRandom is properly seeded, 42–43

limit lifetime of sensitive data, 2–5

minimize privileged code, 54–55

overview, 1–2

prevent arbitrary file upload, 13–16

prevent code injection, 20–23

prevent LDAP injection, 27–31

prevent XPath injection, 23–27

properly encode or escape output, 16–20

provide sensitive mutable classes with unmodifiable wrappers, 9–11

store passwords using hash function, 37–42

Security flaws

careful interface design, 126

defined, 252

nonnative libraries and, 59

Security manager

create secure sandbox using, 67–72

defining permissions, 64–65

preventing code injection, 22–23

Security-sensitive methods, 11–13

SecurityException, 65, 69

Semicolon (;), 180–181

Sensitive code, 252

Sensitive data

defined, 252

limit lifetime of, 2–5

storing unencrypted sensitive information on, 5–9

Sensitive mutable classes, 9–11

Sentinel pattern, 164–165

Serialization

do not serialize direct handles to system resources, 157–158

writeUnshared() and readUnshared(), 239–243

Server-side storage, 5–9

Servlet security managers, 68

Session-fixation attacks, 9

setArray(), 10–11

setFirst(), 210–211

setPassword(), 41

setSecurityManager, 68, 72

SHA (Secure Hash Algorithm), 38, 39–40

Shadow, 132–134, 252

Short-lived objects

do not use direct buffers for, 162–163

garbage-collection-friendly code, 129

remove from long-lived container objects, 163–165

shutdown(), 217

SimpleLock, 93

Simplicity, 79

Single quote ('), 27

sleep(), 216–220

Software reliability. See Reliability

Source Code Analysis Laboratory (SCALe), xiv

Special characters, 27–28

StackOverflowError, 124

startThread(), 49–50

State

logical completeness, 202–204

providing feedback about resulting method value, 96–99

StateLock, 94

static, 225

static final, 138

stop(), 218–219

Storage

password, 37–42

unencrypted sensitive information, 5–9

storeDateInDB(), 32–33

String

abstract object equality vs. reference equality, 222–225

storing passwords using hash functions, 39–40

String.intern(), 223–225

Strings

how escape characters are interpreted when loaded, 228–231

meaningful symbolic constants to represent, 138

Strive for logical completeness, 202–204

Subclasses

ensuring that clone() calls super.clone(), 194–196

interface design, 125, 128

Subobjects, 213

Subscopes, 132–134

SubWorker, 49–50

super.clone(), 194–196

super.startThread(), 50

@SuppressWarnings, 82–84

SureLogic, 90

Sutherland, Dean, 95

switch

assignments in conditional expressions, 176

dead code, 201

finishing case label statements with break, 181–183

logical completeness, 202–203

Symbolic constants, 138–142

Symmetric key algorithm, 38–39

Synchronization

defined, 252

safe publication guarantee and volatile, 211–214

sleep(), yield(), and getState(), 216–220

System errors, 123–125

System resources, 157–158

System.gc(), 130

System.loadLibrary(), 54–55, 58

T

Tenured generation, 129

Terminating loops, 183–186

Testing, 118

Thread-safety

defined, 252

documenting, 89–96

volatile references and, 210, 214–216

Thread.interrupt(), 218

ThreadLocal, 215

Thread.run(), 44

@ThreadSafe, 90–92

throw, 146–147

Throwable, 123–125

Time-of-check, time-of-use (TOCTOU) race condition

assumptions about file creation, 189–190

file identification, 99, 103–105

prevention with state testing, 97

Time values, 31–33

TIMED_WAITING, 219

Tokenization, 224

Tools, xvii

transient, 158

true, 97

Trusted code, 252–253

try-catch block, 123–124

try-catch-finally block, 148–150

Try to gracefully recover from system errors, 123–125

try-with-resources statement, 148–151

Types

declaring variables separately, 135–137

misuse of overloaded methods to differentiate between, 231–233

for second and third operands in conditional expressions, 153–157

U

Unchecked warnings, 82–84

Understand how escape characters are interpreted when strings are loaded, 228–231

Understand the differences between bitwise and logical operators, 225–228

Understandability. See Program understandability

Unencrypted sensitive information, 5–9

Unicode characters, 167–168

@Unique("return"), 94–95

Unmodifiable interfaces, 85

Unmodifiable wrappers, 9–11, 238

UnsupportedOperationException, 10–11

Untrusted code

defined, 253

do not expose methods that use reduced-security checks to, 56–64

do not let misuse privileges of callback methods, 72–77

do not rely on methods that can be overridden by, 44–50

Untrusted method parameters, 31–34

Unused values, 201

updateNode(), 97–98

Uploads, 13–16

Use braces for body of if, for, or while statement, 178–180

Use comments consistently and in readable fashion, 196–198

Use exceptions only for exceptional conditions, 146–148

Use meaningful symbolic constants to represent literal values in program logic, 138–142

Use parentheses for precedence of operation, 186–188

Use same type for second and third operands in conditional expressions, 153–157

Use serialization methods writeUnshared() and readUnshared() with care, 239–243

Use try-with-resources statement to safely handle closeable resources, 148–151

User credentials

preventing LDAP injection, 29

preventing XPath injection, 24–27

storing passwords using hash functions, 37–42

storing unencrypted sensitive information, 5–9

User-defined exceptions, 121–123

UserLookupCallBack, 73–77

util, xvi

V

Validated arguments, 11–13

ValidateOutput, 17–19

validateValue(), 31–32

Values

detect and remove superfluous, 198–202

meaningful symbolic constants to represent literal, 138–142

null. See null values

provide feedback about resulting method, 96–99

Variable arity (varargs) types

avoid ambiguous overloading of, 171–173

compile-time type checking of, 112–115

Variables

do not declare more than one per declaration, 134–137

documenting locking policies, 92–94

encoding relationships in constant definitions, 142–143

minimize scope of, 80–82

minimize scope of @SuppressWarnings, 82

setting local reference to null, 243–244

shadowing, 133–134

Vector, 159

Versions, 116–117

volatile

defined, 253

providing synchronization semantics, 217–218

safe publication guarantee and, 209–216

Vulnerability, 253

W

Wait-notify protocols, 95–96

WAITING, 219–220

Warnings, 82–84

Weak cryptographic algorithms, 36–37

while

assignments in conditional expressions, 175

do not place semicolon immediately following, 180–181

inadvertent wrapping of loop counters, 183–186

use braces for, 178–180

Whitelisting

output sanitization, 17–19

preventing code injection, 21

preventing LDAP injection, 27–28, 30–31

Widget, 47–49

Worker, 49–50

Wrappers

avoid in-band error indicators, 174–175

inadvertent wrapping of loop counters, 183–186

performActionOnFile(), 51–52

unmodifiable, 238

unmodifiable for sensitive mutable classes, 9–11

Write garbage-collection-friendly code, 128–130

writeUnshared(), 239–243

X

XML documents, 23–27

XPath injection, 23–27

XQuery, 25–27

XSS (Cross-Site Scripting) attacks

output sanitization, 16–19

storing unencrypted sensitive information, 5–6

-XX:+DisableExplicitGC, 130

-XX:ExplicitGCInvokedConcurrent, 130

Y

yeild(), 216–220

Younger generation, 129

Z

Zadegan, Bryant, 204

Zune 30, 203–204