Week 7 - Secure Programming Java

Question 1

What are bugs in programming?

Answer 1

A bug is an error, flaw, or fault in the design, development, or operation in a program.

Question 2

Why are security bugs bad?

Answer 2

A security bug or security defect can be exploited to gain unauthorized access or privileges on a computer system.

Question 3

What is directory/path traversal?

Answer 3

Is a web/enterprise application security vulnerability that allows an attacker to read arbitrary files on the host machine without having privileges.

Question 4

In a Java application, what are the two ways path traversal can manifest?

Answer 4

1. Traversal Attempts
   - Attackers manipulate the user input by including special characters like “../” or “%2e%2e%2f” (URL encoded representation of aforementioned) to navigate up the directory structure.
2. Unauthorized Access
   - If application fails to validate the input correctly, it may allow the attacker to access files or directories outside of the intended scope.

Question 5

How to mitigate path traversal?

Answer 5

1. Input Validation
   - Always validate & sanitize user input before using it in file operations. Ensure that user-supplied paths are within the intended directory structure.
2. Canonicalization
   - Use built-in Java methods like File.getCanonicalPath() to canonicalize file paths, which helps eliminate directory traversal attempts by resolving paths to their absolute forms.
3. Security Libraries
   - Utilize security libraries like Apache Commons IO’s FilenameUtils or Path class in Java’s java.nio.file package, which can help prevent path traversal vulnerabilities.

Question 6

What is an integer overflow?

Answer 6

Occurs when arithmetic operation attempts to create a numeric value that is outside of the range that can be represented with a given number of digits.

Question 7

What is the main concern of integer overflow?

Answer 7

May give results leading to unintended behavior. It can compromise a program’s reliability and security.

Question 8

List the three consequences of integer overflows.

Answer 8

1. Wraparound
2. Incorrect Calculations
3. Security Risks

Question 9

What is wraparound, in the context of integer overflow?

Answer 9

Occurs when an arithmetic operation on integers attempts to create a numeric value that is outside of the range that can be represented with a given number of digits

Question 10

In the context of integer overflows, what can happen during incorrect calculations?

Answer 10

The result may be incorrect, leading to erroneous program behavior.

Question 11

What could happen if an integer overflow occurs in security critical code?

Answer 11

If integer overflow occurs in security-critical code, it can potentially be exploited by attackers to manipulate the program’s behavior or security checks.

Question 12

How to mitigate integer overflow?

Answer 12

1. Choose appropriate data types
   - Use data types that can accommodate the expected range of values in your calculations.
2. Range checking
   - Implement range checks and error handling to detect and handle potential overflows gracefully.
3. Use libraries
   - Libraries like Apache Commons Lang provide utilities for safe arithmetic operations that can help avoid integer overflows.
4. Upcasting