Skip to content

Java Security Cheat Sheet / Java安全速查表

This cheat sheet highlights some specific topics for Java applications and references specific Cheat Sheets for more details.

此速查表突出了Java应用程序的一些特定主题，并引用了更多详细信息的特定速查表。

See as well:

另请参阅：

Serialization / 序列化

Java Serialization can potentially be used to trigger arbitrary code execution (Oracle Secure Coding Guidelines for Java SE, section 8):

Java序列化可能被用于触发任意代码执行（Oracle Java SE安全编码指南，第8节）：

  • Do not deserialize untrusted data.
    中文：不要反序列化不受信任的数据。
  • Even deserializing trusted data coming from a database could be a security risk. A compromised database could be exploited to execute arbitrary code in your application.
    中文：即使是从数据库中来的受信任数据反序列化也可能存在安全风险。被破坏的数据库可能被利用来在您的应用程序中执行任意代码。

See the Deserialization Cheat Sheet for more information on this topic.

有关此主题的更多信息，请参阅反序列化速查表。

SQL and JPA injections / SQL和JPA注入

See the following Cheat Sheets for protection against SQL injection protection:

查看以下防SQL注入的备忘单以获取保护方法：

Using an ORM such as JPA/Hibernate does not constitute a blanket protection against injection attacks. JPA/Hibernate applications may be vulnerable to JPQL/HQL injection attacks. Query parameterization is still necessary. See the Query Parameterization Cheat Sheet for example of JPA/Hibernate usage.

使用JPA/Hibernate等ORM并不构成对注入攻击的全面保护。JPA/Hibernate应用程序可能容易受到JPQL/HQL注入攻击的影响。查询参数化仍然是必要的。请参阅查询参数化备忘单以了解JPA/Hibernate的使用示例。

References / 参考