RE: Sample JAVA application

[Tal Mozes <TalM () comsec co il>]

Hi Chris,

 

> From my experience there are a lot of Java specific security issues to check
when doing a code review. I haven't seen a good paper on the subject, but
I'll try to give the start...

 

Issues to check:

 

*         Object Initialization

*         Reducing scope

*         Make Everything final

*         Don't Use Inner classes

*         Don't Depend on Package Protection

*         Avoid Code signing

*         Sign Only JAR Files

*         Make Classes Unclonable

*         Make Classes Unserializeable

*         Make Classes Undeserializeable

*         Don't Compare Classes by Name

*         Storing Secrets in Code 

 

Note that it is not a complete list, but a start.  I hope you'll get the
general idea by now...

Hope it helped,

Tal.

 

Tal Mozes

Application Security Consultant

www.comsec.co.il