Java

Preserve framework security controls across the request lifecycle

Trace middleware, persistence and rendering so custom code does not bypass the protections supplied by the framework.

Development · Developers, AppSec engineers

Harden an Android app's storage, network and entry points

Encrypt local secrets with Android Keystore keys now that Jetpack Security is deprecated, set transport policy in Network Security Configuration, close exported components and mutable PendingIntents, confine WebViews, verify App Links and judge Play Integrity verdicts on the server, mapped to OWASP MASVS 2.1.

Development · Developers, AppSec engineers

Case study: Log4Shell (CVE-2021-44228)

How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.

Release, Maintenance · Developers, AppSec engineers

Prevent NoSQL, LDAP, XPath and expression-language injection

SQL is not the only query language that receives user input. Stop MongoDB operator injection with type checks and $eq, escape LDAP filter values, pass XPath values as variables, and never evaluate SpEL or OGNL built from request data.

Development · Developers, AppSec engineers

Case study: Spring4Shell (CVE-2022-22965)

How Spring's data binding let request parameters reach the class loader on JDK 9 and later in 2022, why the denylist workaround leaked, and what it teaches about framework-level mass assignment.

Development, Maintenance · Developers, AppSec engineers, Platform engineers and SREs

ECB mode: why it leaks patterns and what to use instead

Derive exactly what ECB reveals and why a longer key cannot fix it, find where ECB enters real code, and replace it with an authenticated mode.

Design, Development · Developers

SSTI lab: Render a welcome banner without template injection

A welcome banner is built by concatenating the user’s display name into a Jinja template string, so a crafted name is evaluated as a template: it runs expressions, bypasses autoescaping and reads the render context. Repair render_welcome so the name is data, not template source.