Don't Get Burned: Secure Coding Essentials in Java to protect your application
summary
Live demos show a Spring Boot app vulnerable to SQL injection via JPA createNativeQuery (fixed by prepared/parameterized statements), a file upload exploited with Burp Suite to perform path traversal via uploaded filename and overwrite files, and XML import leaking files via XXE from Java XML parsers (defaults enabled). Recommendations include using Argon2id for password hashing, AES‑GCM for encryption, scanning during development with IDE/CI scanners, updating Spring/SnakeYAML/log4j transitive deps, and using OpenRewrite to automate safe upgrades.
AI-written summary · about
chapters (9)
- 0:00Secure coding in Java
- 4:36Insecure software evolution
- 6:04SQL injection prevention
- 17:30File upload security
- 25:45XML external entity attacks
- 31:26Hashing vs encryption
- 38:09Cryptographic vulnerabilities
- 40:15Third-party library risks
- 45:57Securing Java apps
related talks
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application
52mDon't Get Burned! Secure Coding Essentials in Java to protect your application.
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application
48mThe Hidden Security Hazards in Your Java Stack
56mHow to avoid vulnerabilities and adopt security best practices?
47mThe Hidden Security Hazards in Your Java Stack
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
50mStranger Danger: Your Java Attack Surface Just Got Bigger