Java Code Security
summary
Shows how enabling -Djava.security.manager plus a custom -Djava.security.policy==file restricts dangerous library behavior, with concrete demos: a single System.exit(0) kills Tomcat, an XXE reads /etc/passwd example, and a toy online compiler exploited by path traversal. Walks through the run crash fix loop of adding permissions extracted from thrown exceptions, proves the security manager must hold the superset of stack permissions, and demonstrates the policy approach successfully blocks those attacks.
AI-written summary · about
chapters (7)
- 0:00Start
- 8:32Remote Code Execution Vulnerabilities
- 12:21Xml Parsing
- 13:05External Entities
- 16:09Fixed Code
- 36:18Path Traversal
- 37:05Contents of the Policy File
related talks
43mSecurity Architecture of the Java Platform
44mPractical security in a modular world
42mHidden security features of the JVM - everything you didn’t know and more
44mSecuring the JVM
26mFinding Alternatives to Security Manager
02h 38mJava application security the hard way - a workshop for the serious developer
51mJava - Integrity by Default
48mHidden Security Features of the JVM - Everything You Didn’t Know and More