Don't Get Burned! Secure Coding Essentials in Java to protect your application.
summary
Live demos show SQL injection via string concatenation (copilot-generated search code lets an attacker run "update product set price=0"), file upload path traversal by uploading ../ in filename (burp suite proxy writes a file into project root), and XML XXE reading /etc/passwd. Replacements: use prepared/parameterized queries, validate or normalize file paths, disable DTD/external entities in XML parsers. Recommendations include Argon2id for password hashing with migration strategy, AES-GCM for encryption modes, update frameworks, scan dependencies, and return DTOs instead of raw entities.
AI-written summary · about
chapters (11)
- 0:00Introduction and setup
- 3:20From POC to fragile architecture
- 8:41SQL injection vulnerabilities
- 14:20Path traversal in file uploads
- 23:52XML external entity attacks
- 29:17Hashing vs encryption basics
- 37:02Password hashing with Argon2
- 42:00Cryptography pitfalls and updates
- 42:21Library and framework risks
- 45:55Sensitive data exposure
- 49:05Getting started with secure coding
related talks
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application
47mThe Hidden Security Hazards in Your Java Stack
48mThe Hidden Security Hazards in Your Java Stack
53mOWASP Top Ten Proactive Controls
01h 04mWeb Security And You
30mWeb Security Engineering - Protect all layers of your project