🏷 Security
8 patterns
Topic: Security
All Java patterns related to Security — java.evolved
I/O
Deserialization filters
Old
// Dangerous: accepts any class
ObjectInputStream ois =
new ObjectInputStream(input);
Object obj = ois.readObject();
// deserialization attacks possible!
Modern
ObjectInputFilter filter =
ObjectInputFilter.Config
.createFilter(
"com.myapp.*;!*"
);
ois.setObjectInputFilter(filter);
Object obj = ois.readObject();
hover to see modern →
JDK 9+
learn more →
Security
PEM encoding/decoding
Old
String pem = "-----BEGIN CERTIFICATE-----\n"
+ Base64.getMimeEncoder()
.encodeToString(
cert.getEncoded())
+ "\n-----END CERTIFICATE-----";
Modern
// Encode to PEM
String pem = PEMEncoder.of()
.encodeToString(cert);
// Decode from PEM
var cert = PEMDecoder.of()
.decode(pemString);
hover to see modern →
JDK 25+
learn more →
Security
Standard Base64 encoding and decoding
Old
String encoded = new sun.misc.BASE64Encoder()
.encode(data);
Modern
String encoded = Base64.getEncoder()
.encodeToString(data);
hover to see modern →
JDK 8+
learn more →
Security
Key Derivation Functions
Old
SecretKeyFactory factory =
SecretKeyFactory.getInstance(
"PBKDF2WithHmacSHA256");
KeySpec spec = new PBEKeySpec(
password, salt, 10000, 256);
SecretKey key =
factory.generateSecret(spec);
Modern
var kdf = KDF.getInstance("HKDF-SHA256");
SecretKey key = kdf.deriveKey(
"AES",
KDF.HKDFParameterSpec
.ofExtract()
.addIKM(inputKey)
.addSalt(salt)
.thenExpand(info, 32)
.build()
);
hover to see modern →
JDK 25+
learn more →
Security
Strong random generation
Old
// Default algorithm — may not be
// the strongest available
SecureRandom random =
new SecureRandom();
byte[] bytes = new byte[32];
random.nextBytes(bytes);
Modern
// Platform's strongest algorithm
SecureRandom random =
SecureRandom.getInstanceStrong();
byte[] bytes = new byte[32];
random.nextBytes(bytes);
hover to see modern →
JDK 9+
learn more →
Security
TLS 1.3 by default
Old
SSLContext ctx =
SSLContext.getInstance("TLSv1.2");
ctx.init(null, trustManagers, null);
SSLSocketFactory factory =
ctx.getSocketFactory();
// Must specify protocol version
Modern
// TLS 1.3 is the default!
var client = HttpClient.newBuilder()
.sslContext(SSLContext.getDefault())
.build();
// Already using TLS 1.3
hover to see modern →
JDK 11+
learn more →
Security
SecurityManager checks to explicit authorization
Old
SecurityManager manager = System.getSecurityManager();
if (manager != null) {
manager.checkRead(path.toString());
}
return Files.readString(path);
Modern
// Untrusted users must not be able to modify this tree
Path root = allowedRoot.toRealPath();
Path resolved = root.resolve(requested)
.normalize()
.toRealPath();
if (!resolved.startsWith(root)) {
throw new SecurityException(
"Path is outside the allowed root");
}
return Files.readString(resolved);
hover to see modern →
JDK 24+
learn more →
Tooling
Runtime.exec(String) to ProcessBuilder arguments
Old
Process process = Runtime.getRuntime()
.exec("git show " + revision);
Modern
Process process = new ProcessBuilder(
"git", "show", revision)
.redirectErrorStream(true)
.start();
hover to see modern →
JDK 5+
learn more →