![The Anti-Pattern
input = GET[ username ]
statement = code + input
execute( statement )](https://image.slidesharecdn.com/antipattern-130805080334-phpapp01/85/The-Anti-pattern-3-320.jpg)
![Defense in Depth
input = GET[ username ]
if (whitelist.bad( input )) {
secLog(reject)
throw new Exception()
}](https://image.slidesharecdn.com/antipattern-130805080334-phpapp01/85/The-Anti-pattern-12-320.jpg)
The Anti pattern
- 3. The Anti-Pattern input = GET[ username ] statement = code + input execute( statement )
- 4. The Anti-Pattern sql ldap eval response.write file.open reflection control.the.computer INPUT EXECUTE
- 6. Code not Text! Text query languages suck. Critera & Entity API: WIN
- 7. Code not Text Root<Pet> pet = cq.from(Pet.class) cq.where(cb.equals(pet.get(Pet_.name), input)) s = SELECT FROM pet WHERE pet.name = + input executeSQL( s )
- 8. Fear String.Concat Parameterized Queries: use wildcards instead of concatenating user input
- 9. Remove String.Concat s = SELECT FROM pet WHERE pet.name = @name ps = prepare( s ) ps.bind(@name, input) s = SELECT FROM pet WHERE pet.name = + input executeSQL( s )
- 10. Defense in depth
- 12. Defense in Depth input = GET[ username ] if (whitelist.bad( input )) { secLog(reject) throw new Exception() }
- 13. Summary Most common security coding vulns are variants of the same anti-pattern Use easy safe-by-design API Entity & Criteria API SQLi is hard =) Fear String.Concat String operations are the mother of all evil Parameterize if you must stick to text! Defend in Depth! The anti-pattern can also be broken by input validation.