Magnus K Karlsson

October 24, 2018

Input Validation - OWASP Java HTML Sanitizer

Why Sanitizing?

If you perform good validation, you stopping attackers by getting in your application via the UI. The input validation strength is in the following order.

White List. Accept only known good characters and send error back to user.
Sanitizing. Accept only known good characters and silently remove others and proceed.
Escape. Accept only known good characters and escape others and proceed.
Black List. Accept everything accept predefined bad ones.

https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet

OWASP Java HTML Sanitizer

OWASP has a free sanitizing library that has been tested thoroughly. https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project


<dependency>
 <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
 <artifactId>owasp-java-html-sanitizer</artifactId>
 <version>20180219.1</version>
 <scope>test</scope>
</dependency>


String untrustedHTML = "<html><p>hello</p></html>";

// Sanitizers.FORMATTING allows common formatting elements, currently these
// "b", "i", "font", "s", "u", "o", "sup", "sub", "ins", "del", "strong",
// "strike", "tt", "code", "big", "small", "br", "span", "em"

// Sanitizers.BLOCKS allows common blocks elements, currently these
// "p", "div", "h1", "h2", "h3", "h4", "h5", "h6", "ul", "ol", "li",
// "blockquote"

PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.FORMATTING).and(Sanitizers.BLOCKS);
String safeHTML = policy.sanitize(untrustedHTML);
System.out.println("safeHTML='" + safeHTML + "'");


safeHTML='<p>hello</p>'

JavaFX Markup for User Interface

Tired of writing code for creating your user interface? What if you could layout your user interface via an file? E.g.


<BorderPane>
    <top>
        <Label text="Page Title"/>
    </top>
    <center>
        <Label text="Some data here"/>
    </center>
</BorderPane>

That is exactly what FXML is all about in JavaFX.

https://docs.oracle.com/javase/8/javafx/fxml-tutorial/

ControlsFX Excellent JavaFX Framework

A great JavaFX framework is ControlsFX.

http://fxexperience.com/controlsfx/

http://fxexperience.com/controlsfx/features/

Bulkhead and Backpressure Pattern with Java EE 7

What is Bulkhead Pattern?

https://en.wikipedia.org/wiki/Bulkhead_(partition)

"Isolate elements of an application into pools so that if one fails, the others will continue to function.

This pattern is named Bulkhead because it resembles the sectioned partitions of a ship's hull. If the hull of a ship is compromised, only the damaged section fills with water, which prevents the ship from sinking."

https://docs.microsoft.com/en-us/azure/architecture/patterns/bulkhead

What is Backpressure Pattern?

Backpressure is about sending good information back to your users that your application is under heavy load and cannot fulfill it's SLA.

https://mechanical-sympathy.blogspot.com/search?q=applying+back+pressure+when+overloaded

Java EE 7 Bulkhead and Backpressure Implementation

https://blog.sebastian-daschner.com/entries/bulkheads-backpressure-javaee

https://github.com/AdamBien/porcupine

Circuit Breaker Pattern with Java EE 7

What is Circuit Breaker Pattern?

It is fail fast (and in a controlled way, with good error and logging message), when your application is under load. If your application does not handle load gracefully, your application will continue to accept incoming request and that makes performance of your application worse, but more important makes the response time even worse for the connecting clients.

"Handle faults that might take a variable amount of time to recover from, when connecting to a remote service or resource. This can improve the stability and resiliency of an application."

https://docs.microsoft.com/en-us/azure/architecture/patterns/circuit-breaker

Java EE 7 Circuit Breaker Implementation


@Singleton
@Interceptors(Breakr.class)
@ConcurrencyManagement(ConcurrencyManagementType.BEAN)
public class Brittle {

    @IgnoreCallsWhen(failures = 2,slowerThanMillis = 10)
    public void unstableAndSlow(){
    }

    @CloseCircuit
    public void reset() {}
}

http://www.adam-bien.com/roller/abien/entry/a_6kb_circuit_breaker_for

October 22, 2018

Applet and Java Web Start is Dead in Java 11

Oracle JDK for Windows is Not Free Anymore

Oracle JDK

Starting from Januari 2019 you need to pay Oracle to use Oracle Java 8 in production. Downloading and using Oracle Java 8 for developing and testing is fine.

"Oracle Customers. Oracle Customers are those Oracle customers with an active (1) Java SE Subscription and/or Java SE Desktop Subscription, (2) support contract for Oracle Java SE Advanced, Oracle Java SE Advanced Desktop, Oracle Java SE Suite, and/or Java SE Support, or (3) Java SE support entitlement for use of Java SE solely with another Oracle product (Visit My.Oracle Support Note 1439822.1 - All Java SE Downloads on MOS – Requires Support Login)."

"Commercial Users. Commercial Users are entities other than Oracle Customers that use Java SE for business, commercial or production purposes as part of a Java application delivered by a third party or developed internally."

"Personal Users. Personal Users are individuals who use Java SE on personal desktops or laptops. Personal users include individuals using Oracle Java SE to develop applications for hobby or educational purposes, play games or run consumer productivity applications."

And also https://blogs.oracle.com/java-platform-group/oracle-jdk-releases-for-java-11-and-later

OpenJDK for Linux

If you running Linux already, you are also probably also already running OpenJDK, otherwise start use OpenJDK instead of Oracle Java. OpenJDK is natively packaged for Linux so only search for install software on your Linux distro.

To read more https://openjdk.java.net/

But things are also changing for OpenJDK, Oracle wants to skip LTS for OpenJDK and deliver new Major versions every 6 months!

But Red Hat will deliver a OpenJDK 11 LTS for RHEL, https://access.redhat.com/articles/3409141

And Red Hat will deliver this LTS version for Windows as well, but only for Developing purpose https://developers.redhat.com/products/openjdk/download/.

About Red Hat support for OpenJDK 7, 8 and 11 on RHEL platform.

"In addition to distributing and providing lifecycle support for OpenJDK on Red Hat Enterprise Linux, Red Hat’s open source Java middleware products support OpenJDK for Red Hat Enterprise Linux, enabling users to get a full stack support from the operating system through to application services from a single vendor, and other Red Hat products internally run on OpenJDK. We are a leader in offering support to customers worldwide that rely on open source to run their production workloads."

https://www.redhat.com/en/blog/history-and-future-openjdk