Home|About|Gaming cabinet|Archives|How it works|Starter sites

GeezerVison is showing javaevolved.dev — Security — java.evolved

Home / Topics / Security

🏷 Security 8 patterns

Topic: Security

All Java patterns related to Security — java.evolved

Deserialization filters

Old // Dangerous: accepts any class ObjectInputStream ois = new ObjectInputStream(input); Object obj = ois.readObject(); // deserialization attacks possible!

Modern ObjectInputFilter filter = ObjectInputFilter.Config .createFilter( "com.myapp.*;!*" ); ois.setObjectInputFilter(filter); Object obj = ois.readObject();

hover to see modern →

JDK 9+ learn more →

PEM encoding/decoding

Old String pem = "-----BEGIN CERTIFICATE-----\n" + Base64.getMimeEncoder() .encodeToString( cert.getEncoded()) + "\n-----END CERTIFICATE-----";

Modern // Encode to PEM String pem = PEMEncoder.of() .encodeToString(cert); // Decode from PEM var cert = PEMDecoder.of() .decode(pemString);

hover to see modern →

JDK 25+ learn more →

Standard Base64 encoding and decoding

Old String encoded = new sun.misc.BASE64Encoder() .encode(data);

Modern String encoded = Base64.getEncoder() .encodeToString(data);

hover to see modern →

JDK 8+ learn more →

Key Derivation Functions

Old SecretKeyFactory factory = SecretKeyFactory.getInstance( "PBKDF2WithHmacSHA256"); KeySpec spec = new PBEKeySpec( password, salt, 10000, 256); SecretKey key = factory.generateSecret(spec);

Modern var kdf = KDF.getInstance("HKDF-SHA256"); SecretKey key = kdf.deriveKey( "AES", KDF.HKDFParameterSpec .ofExtract() .addIKM(inputKey) .addSalt(salt) .thenExpand(info, 32) .build() );

hover to see modern →

JDK 25+ learn more →

Strong random generation

Old // Default algorithm — may not be // the strongest available SecureRandom random = new SecureRandom(); byte[] bytes = new byte[32]; random.nextBytes(bytes);

Modern // Platform's strongest algorithm SecureRandom random = SecureRandom.getInstanceStrong(); byte[] bytes = new byte[32]; random.nextBytes(bytes);

hover to see modern →

JDK 9+ learn more →

TLS 1.3 by default

Old SSLContext ctx = SSLContext.getInstance("TLSv1.2"); ctx.init(null, trustManagers, null); SSLSocketFactory factory = ctx.getSocketFactory(); // Must specify protocol version

Modern // TLS 1.3 is the default! var client = HttpClient.newBuilder() .sslContext(SSLContext.getDefault()) .build(); // Already using TLS 1.3

hover to see modern →

JDK 11+ learn more →

SecurityManager checks to explicit authorization

Old SecurityManager manager = System.getSecurityManager(); if (manager != null) { manager.checkRead(path.toString()); } return Files.readString(path);

Modern // Untrusted users must not be able to modify this tree Path root = allowedRoot.toRealPath(); Path resolved = root.resolve(requested) .normalize() .toRealPath(); if (!resolved.startsWith(root)) { throw new SecurityException( "Path is outside the allowed root"); } return Files.readString(resolved);

hover to see modern →

JDK 24+ learn more →

Runtime.exec(String) to ProcessBuilder arguments

Old Process process = Runtime.getRuntime() .exec("git show " + revision);

Modern Process process = new ProcessBuilder( "git", "show", revision) .redirectErrorStream(true) .start();

hover to see modern →

JDK 5+ learn more →