CRV2 RevCodePersistentAntiPatternJava - Revision history

Johanna Curiel at 10:00, 4 October 2013

2013-10-04T10:00:33Z

Johanna Curiel at 09:56, 4 October 2013

2013-10-04T09:56:24Z

Johanna Curiel at 09:41, 4 October 2013

2013-10-04T09:41:53Z

Johanna Curiel at 09:41, 4 October 2013

2013-10-04T09:41:04Z

Johanna Curiel at 09:40, 4 October 2013

2013-10-04T09:40:22Z

Johanna Curiel at 09:26, 4 October 2013

2013-10-04T09:26:53Z

Johanna Curiel at 09:13, 4 October 2013

2013-10-04T09:13:27Z

Johanna Curiel at 21:06, 3 October 2013

2013-10-03T21:06:58Z

Johanna Curiel at 20:45, 3 October 2013

2013-10-03T20:45:51Z

Johanna Curiel at 20:41, 3 October 2013

2013-10-03T20:41:54Z

@@ Line 22: / Line 22: @@
 This anti pattern is caused by the opening and closing of individual sessions for each call executed to the database. In order to avoid this issue, make sure the calls are planned in sequence.
 Control proper implementation of persistence context. Problem occurs when DAO uses different persistence context for each one, in other words, a different Session or EntityManager.
 ===Open Conversation anti-pattern===

@@ Line 24: / Line 24: @@
 ===Open Conversation anti-pattern===
-Keeping a database session alive while a user 'a' is editing data meanwhile, a lock is exerted to avoid concurrency issues can cause serious performance issues and bottlenecks in the application.
+Keeping a database session alive while a user 'a' is editing data meanwhile, a lock is exerted to avoid concurrency issues can cause serious performance and bottlenecks in the application.
 It is not advisable to do this in order to keep data integrity. There are other Hibernate features that allows the developer to handle sessions in  a much efficient way such as automatic optimistic concurrency

@@ Line 21: / Line 21: @@
 This anti pattern is caused by the opening and closing of individual sessions for each call executed to the database. In order to avoid this issue, make sure the calls are planned in sequence.
-Control proper implementation of persistence context. Problem occurs when DAO use different persistence context for each one, in other words, a different Session or EntityManager.
+Control proper implementation of persistence context. Problem occurs when DAO uses different persistence context for each one, in other words, a different Session or EntityManager.
 ===Open Conversation anti-pattern===

@@ Line 18: / Line 18: @@
 *Review Tuning fetching strategies from Hibernate reference (http://docs.jboss.org/hibernate/core/3.3/reference/en/html/performance.html#performance-fetching-custom)
-===Hibertane issues with DAO (Data Access Objects): Sessions per Operation anti-pattern===
+===Sessions per Operation anti-pattern===
 This anti pattern is caused by the opening and closing of individual sessions for each call executed to the database. In order to avoid this issue, make sure the calls are planned in sequence.

@@ Line 22: / Line 22: @@
 This anti pattern is caused by the opening and closing of individual sessions for each call executed to the database. In order to avoid this issue, make sure the calls are planned in sequence.
 Control proper implementation of persistence context. Problem occurs when DAO use different persistence context for each one, in other words, a different Session or EntityManager.
 ==Long Term Persistence Security Issues==

@@ Line 20: / Line 20: @@
 ===Hibertane issues with DAO (Data Access Objects): Sessions per Operation anti-pattern===
 Control proper implementation of persistence context. Problem occurs when DAO use different persistence context for each one, in other words, a different Session or EntityManager.
@@ Line 56: / Line 57: @@
 ==References==
 Oracle, 2013 "Java Tutorials" available at http://docs.oracle.com/javase/tutorial/javabeans/advanced/longpersistence.html Accessed on 3rd October 2013

@@ Line 3: / Line 3: @@
 ==Spring –Hibernate Anti-patterns==
-Some of the following anti-patterns are an important concerns on the security area for Java applications. A related problem with these anti-patterns is data integrity.
+Some of the following anti-patterns are an important concern in the security area of Java applications. A related problem with these anti-patterns is data integrity.
 ===Lazy loading===

@@ Line 39: / Line 39: @@
 And the 2nd case is exactly what happens with Restlet REST API , which wraps XMLDecode in its org.restlet.representation.ObjectRepresentation<T> feature/class."(Cruz, 2013)
-An Example of a payload which can be fond in Github from many examples created by Cruz , creates an item
+An Example of an attack which can be fond in Github from many examples created by Cruz , creates an item
   <?xml version="1.0" encoding="UTF-8"?>
@@ Line 51: / Line 51: @@
   new firstResource.Item("a Name" , "a Description");
   -->
 ==References==

← Older revision		Revision as of 20:41, 3 October 2013
Line 21:		Line 21:

	Control proper implementation of persistence context. Problem occurs when DAO use different persistence context for each one, in other words, a different Session or EntityManager.		Control proper implementation of persistence context. Problem occurs when DAO use different persistence context for each one, in other words, a different Session or EntityManager.
		+
		+	==Long Term Persistence Security Issues==
		+	Long-term persistence is a model that enables beans to be saved in XML format.(Java Tutorial, 2013). For this purpose, a programmer can use XMLEncoder class to pass through output files for textual representation of Serializable objects.In the example provided in the Java Tutorial, the programmer can invoke and create an instance of javax.swing.JButton such as this
		+
		+	<object class="javax.swing.JButton">
		+	<void method="setText">
		+	<string>Cancel</string>
		+	</void>
		+	</object>
		+
		+	The vulnerability occurs when instead of passing acquitted XML code, the attacker sends dangerous Payloads. This vulnerability was shown by Dinis Cruz, Alvaro Muñoz and Abraham Kang in DefCon Conference 2013 “Resting on Your Laurels will get you Pwned: Effectively Code Reviewing REST Applications to avoid getting powned”
		+
		+	As explained by Dinis Cruz (2013) in his blog "there are two key scenarios where this ‘feature’ becomes a spectacular vulnerability:
		+	*Server-side backend system that process attacker-controlled XML files using XMLDecoder
		+	*REST APIs that uses XMLDecoder to create strongly type objects from the HTTP Request data
		+
		+	And the 2nd case is exactly what happens with Restlet REST API , which wraps XMLDecode in its org.restlet.representation.ObjectRepresentation<T> feature/class."(Cruz, 2013)
		+
		+	==References==
		+
		+	Oracle, 2013 "Java Tutorials" available at http://docs.oracle.com/javase/tutorial/javabeans/advanced/longpersistence.html Accessed on 3rd October 2013
		+
		+	Dinis Cruz, 2013 "Using XMLDecoder to execute server-side Java Code on an Restlet application (i.e. Remote Command Execution)" available at http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html Accessed on 3rd October 2013