CS-Java_Security Java Security Cheat Sheet

Java Serialization can potentially be used to trigger arbitrary code execution (Oracle Secure Coding Guidelines for Java SE, section 8): • Do not deserialize untrusted data. • Even deserializing trusted data coming from a database could be a security risk. A compromised database could be exploited to execute arbitrary code in your application. See the Deserialization Cheat Sheet for more information on this topic.

See the following Cheat Sheets for protection against SQL injection protection: • SQL Injection Prevention Cheat Sheet; • Query Parameterization Cheat Sheet. Using an ORM such as JPA/Hibernate does not constitute a blanket protection against injection attacks. JPA/Hibernate applications may be vulnerable to JPQL/HQL injection attacks. Query parameterization is still necessary. See the Query Parameterization Cheat Sheet for example of JPA/Hibernate usage.

• Oracle: Secure Coding Guidelines for Java SE • OWASP WSTG: ORM Injection