ISBN : 0321803957
Publisher : Addison Wesley
An essential element of secure coding in the Java programming
language is a well-documented and enforceable coding standard. Coding
standards encourage programmers to follow a uniform set of rules
determined by the requirements of the project and organization, rather
than by the programmer’s familiarity or preference. Once established,
these standards can be used as a metric to evaluate source code (using
manual or automated processes).
The CERT® Oracle® Secure Coding Standard for Java™ provides rules
designed to eliminate insecure coding practices that can lead to
exploitable vulnerabilities. Application of the standard’s guidelines
will lead to higher-quality systems–robust systems that are more
resistant to attack. Such guidelines are required for the wide range of
products coded in Java–for devices such as PCs, game players, mobile
phones, home appliances, and automotive electronics.
After a high-level introduction to Java application security,
seventeen consistently organized chapters detail specific rules for key
areas of Java development. For each area, the authors present
noncompliant examples and corresponding compliant solutions, show how to
assess risk, and offer references for further information. Each rule is
prioritized based on the severity of consequences, likelihood of
introducing exploitable vulnerabilities, and cost of remediation.
The standard provides secure coding rules for the Java SE 6
Platform including the Java programming language and libraries, and also
addresses new features of the Java SE 7 Platform. It describes language
behaviors left to the discretion of JVM and compiler implementers,
guides developers in the proper use of Java’s APIs and security
architecture, and considers security concerns pertaining to standard
extension APIs (from the javax package hierarchy).The standard covers
security issues applicable to these libraries: lang, util, Collections,
Concurrency Utilities, Logging, Management, Reflection, Regular
Expressions, Zip, I/O, JMX, JNI, Math, Serialization, and JAXP.
