Top Security Flaws Hiding in Your Code Right Now – and How to Fix Them
summary
Live SonarCloud telemetry shows 151,000 SQL injection issues and 400,000 logging issues across projects; demos prove string-concatenation queries authenticate as admin while prepared statements block the exploit. A crafted serialized payload opens calculator during deserialization until a custom ObjectInputStream validation blocks class instantiation. Log4Shell demo uses an LDAP JNDI lookup to download and execute a remote class; mitigations are disable lookups, update Log4j/JDK, or implement an allowlist. SonarQube flags problems and offers an auto-fix snippet for quick remediation.
AI-written summary · about
chapters (6)
- 0:00Introduction and context
- 5:03Injection vulnerability types
- 11:25SQL injection explained
- 16:00Deserialization vulnerabilities
- 28:25Logging and remote execution
- 37:42Tools, conclusions, and Q&A
related talks
48mThe Hidden Security Hazards in Your Java Stack
47mThe Hidden Security Hazards in Your Java Stack
50mStranger Danger: Your Java Attack Surface Just Got Bigger
51mDouble plus Ungood Why Log4Shell Is So Bad
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application