The Hidden Security Hazards in Your Java Stack
summary
Cloud‑native Java workflows produce concrete risks: an AI assistant (Copilot) outputs code that enables SQL injection via concatenated queries, Burp Suite captures multipart uploads that allow ../ path‑traversal and arbitrary file overwrite, and a naive SAX parser permits XXE exfiltration of /etc/passwd. Live demos show Log4Shell exploiting JNDI/LDAP to execute a remote class, Spring Boot pulling 33 jars/9k classes/500k LOC, and Snyk finds 60,000+ projects still using vulnerable Log4j; fixes use prepared statements/JPA checks, path normalization, XML disable‑doctype, patched base images, and Snyk/OpenRewrite scans.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 3:23Software deployment speed
- 5:04Shared security responsibility
- 6:08Code reviews and vulnerabilities
- 8:15AI code and SQL injection
- 16:35File upload vulnerabilities
- 24:41XML parsing and XXE
- 28:15API data exposure
- 31:04Log4j case study
- 37:48Security responsibility
- 38:29Container security
- 42:27Infrastructure misconfigurations
- 43:31Secure development culture
- 45:19Legacy software updates
- 47:07Conclusion
related talks
47mThe Hidden Security Hazards in Your Java Stack
50mStranger Danger: Your Java Attack Surface Just Got Bigger
48mCommon vulnerabilities you wish your Java app didn't have!
01h 06mLive hacking: Breaking into your Java web app
43mLive hacking: Breaking into your Java web app
26mStranger Danger: Your Attack Surface Just Got Bigger
02h 38mJava application security the hard way - a workshop for the serious developer
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application