<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
version="4.0">
<session-config>
<session-timeout>15</session-timeout> <cookie-config>
<secure>true</secure>
<http-only>true</http-only>
</cookie-config>
</session-config>
</web-app>
Common Attack Vectors
How Attacks Happen (Conceptual Java Example)
ObjectInputStream.readObject() method is the entry point for deserialization. Without
careful validation and sanitization of the input, it will attempt to reconstruct any Java object
from the byte stream. Attackers can create malicious byte streams that, when deserialized,
construct objects designed to trigger harmful actions.Countermeasures & Best Practices
byte[] serializedData = getUntrustedData(); // From network, file, etc.
// 1. Create a filter that allows only specific classes (whitelist)
BinaryOperator<ObjectInputStream, ObjectInputFilter>
filterFactory =
(ois, serialFilter) -> ObjectInputFilter.Config.createFilter(
"com.example.*;!*"); // Allow only classes in com.example package
// 2. Set the filter factory on the ObjectInputStream
try (ObjectInputStream ois = new ObjectInputStream(new
ByteArrayInputStream(serializedData))) {
ois.setObjectInputFilter(filterFactory.apply(ois, null)); // Apply the filter
Object obj = ois.readObject(); // Now safer, but STILL requires caution
System.out.println("Deserialized object: " + obj);
}
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
version="4.0">
<session-config>
<session-timeout>15</session-timeout> <cookie-config>
<secure>true</secure>
<http-only>true</http-only>
</cookie-config>
</session-config>
</web-app>
Vettori di attacco comuni
Come avvengono gli attacchi (esempio concettuale Java)
ObjectInputStream.readObject() è il punto di ingresso per la deserializzazione. Senza un’
attenta convalida e sanificazione dell’input, tenterà di ricostruire qualsiasi oggetto Java
dal flusso di byte. Gli aggressori possono creare flussi di byte dannosi che, una volta deserializzati,
costruiscono oggetti progettati per attivare azioni dannose.Contromisure e best practice
byte[] serializedData = getUntrustedData(); // From network, file, etc.
// 1. Create a filter that allows only specific classes (whitelist)
BinaryOperator<ObjectInputStream, ObjectInputFilter>
filterFactory =
(ois, serialFilter) -> ObjectInputFilter.Config.createFilter(
"com.example.*;!*"); // Allow only classes in com.example package
// 2. Set the filter factory on the ObjectInputStream
try (ObjectInputStream ois = new ObjectInputStream(new
ByteArrayInputStream(serializedData))) {
ois.setObjectInputFilter(filterFactory.apply(ois, null)); // Apply the filter
Object obj = ois.readObject(); // Now safer, but STILL requires caution
System.out.println("Deserialized object: " + obj);
}
The Architect: Hello, Neo. Neo: Who are you? The Architect: I am the Architect. I created the matrix. I’ve been waiting for you. You have many questions, and although the process has altered your consciousness, you remain irrevocably human. Ergo, some of my answers you will understand, and some of them you will not. Concordantly, while your first question may be the most pertinent, you may or may not realize it is also the most irrelevant. Neo: Why am I here? The Architect: Your life is the sum of a remainder of an unbalanced equation inherent to the programming of the matrix. You are the eventuality of an anomaly, which despite my sincerest efforts I have been unable to eliminate from what is otherwise a harmony of mathematical precision. While it remains a burden assiduously avoided, it is not unexpected, and thus not beyond a measure of control. Which has led you, inexorably, here. Neo: You haven’t answered my question. The Architect: Quite right. Interesting. That was quicker than the others. … From “The Matrix Reloaded”
A Software Architect is a professional who designs and develops the architecture of a software system, defining its technical specifications and components. He or she ensures that the software meets business needs, is efficient, scalable and easy to maintain.
One of the core functionalities of a VCS like Git is tagging. Tagging allows you to mark specific points in your codebase history, often designating a significant release or milestone. Git offers two types of tags: annotated tags and lightweight tags. This article focuses on the benefits and creation of annotated tags, which provide additional information and a reference point.
Understanding Annotated Tags
Nowadays, annotated tags play a crucial role in maintaining organized and well-documented codebases. They not only provide a reference point in your code history but also store additional information. This information, typically a descriptive message, can explain the purpose or significance of the tagged version. By incorporating annotated tags into your development workflow, you can enhance the clarity and traceability of your project’s evolution.
Creating Annotated Tags with Git
The following command creates an annotated tag in your Git repository:
git tag -a <tag_name> -m "<comment>"
where
Once you’ve created your annotated tag, you can share it with collaborators by pushing it to a remote repository.
Here’s the command:
git push origin <tag_name>
Benefits of Annotated Tags
Clear Context: The comment associated with an annotated tag provides valuable context for understanding the tagged version’s purpose or content.
Improved Collaboration: Sharing annotated tags streamlines collaboration by giving your team a clear reference point with additional information. Version Tracking: Annotated tags serve as historical markers, allowing you to easily revisit specific versions of your codebase.
By effectively utilizing annotated tags, you can enhance your project’s organization, clarity, and collaboration for your development team. In today’s collaborative development environment, annotated tags have become an essential tool for maintaining a well-managed and well-documented codebase.
To list stored tags in a repo execute the following:
git tag
This definition, although more formal, maintains the essence of the monad concept as a container for values and behaviour.
To highlight the structural and algebraic aspect of monads, we can use the following formulation:
In some other fashion, the triplet (T, η, μ) defines the rules for the manipulation of values within the monad, ensuring consistent and uniform behaviour.
Example:
The monad Maybe, used to handle null values, can be defined as:
This formal definition, although it may seem difficult at first sight, provides a solid basis for understanding the inner workings of monads and their power in functional programming
]]>Simplicity is hard work. But, there’s a huge payoff. The person who has a genuinely simpler system - a system made out of genuinely simple parts, is going to be able to affect the greatest change with the least work. He’s going to kick your ass. He’s gonna spend more time simplifying things up front and in the long haul he’s gonna wipe the plate with you because he’ll have that ability to change things when you’re struggling to push elephants around. – Rich Hickey, Creator of the Clojure programming language.
I’ve heard a lot of people say that there are no good books on Clojure, or that the resources available are too limited. I’m here to tell you that this is not true! There are a number of excellent Clojure books available, covering a wide range of topics.
Here is a list of Clojure books that I think are great.
Mark McDonnell Publisher: Apress Copyright © 2017
MICHAEL FOGUS CHRIS HOUSER Publisher: Manning Publications Co. Copyright © 2011
]]>To write a small Prolog engine or expert system, you first need to define the domain of the problem that you want to solve. This means defining the key concepts of the domain, the relationships between the concepts, and the rules that govern the domain. Once you have defined the domain, you can write the Prolog code that implements the expert system.
The Prolog code for an expert system consists of a set of facts and rules. Facts are statements that are true about the domain. Rules are statements that describe how the facts are related to each other. To solve a problem, the expert system starts with a set of facts and applies the rules to deduce new facts. The process continues until the expert system is unable to deduce a solution to the problem.
Here is an example of a small expert system that can be used to diagnose diseases. The domain of the problem is medicine and the key concepts are symptoms, diseases, and drugs. The rules describe how the symptoms are related to the diseases and how the diseases are related to the drugs. To diagnose a disease, the expert system starts with a set of symptoms and applies the rules to deduce the possible diseases. The expert system then provides a list of the possible diseases and the doctor can then select the most likely disease.
Writing a small Prolog engine or expert system is an interesting idea because it can be used to solve a wide range of problems. Expert systems can be used to solve problems that are difficult or impossible for humans to solve, such as medical diagnosis or financial planning. Additionally, expert systems can be used to automate tasks that are currently performed by humans, such as customer support or report generation.
Prolog code for a small expert system that can be used to infer family relationships
% Definitions of facts
father(john, peter).
father(john, paul).
mother(mary, peter).
% Definitions of rules
is_sibling(X,Y) :- father(Z,X), father(Z,Y), X\=Y.
is_child(X,Y) :- father(Y,X).
is_father(X,Y) :- father(X,Y).
is_mother(X,Y) :- mother(X,Y).
% Query
?- is_sibling(peter, paul).
true.
?- is_child(peter, john).
true.
?- is_father(john, peter).
true.
?- is_mother(mary, peter).
true.
If you are interested in writing a small Prolog engine or expert system, there are many resources available online. You can find tutorials, example code, and libraries that can help you get started.
]]>When a parameter is passed by value, the value of the parameter is copied into the method. If the value of the parameter is changed in the method, the change will not be reflected in the value of the original parameter.
For istance, the following pseudocode passes an integer by value to a method:
proc foo(by val number)
number = 10
endproc
number = 5
foo(number)
print(number) # the output is 5
In the above pseudocode, the foo() method is called with the value 5 as an argument. The value 5 is copied into the number variable inside the method. The number variable is then set to the value 10. However, the change in the value of number is not reflected in the value of the original number. When the foo() method terminates, the value of number is still 5.
When a parameter is passed by reference, the reference to the parameter is copied into the method. If the value of the parameter is changed in the method, the change will be reflected in the value of the original parameter.
For example, the following pseudocode passes an object by reference to a method:
proc foo(by ref person)
person.name = "Mark"
endproc
person = Person("Luke")
foo(person)
print(person.name) # Prints Mark
In the above pseudocode, the foo() method is called with the object person as an argument. The reference to the object person is copied into the person variable inside the method. The person variable is then used to change the name of the object. The change in the name of the object is reflected in the original object. When the foo() method terminates, the name of the object is still Mark.
The type of parameter passing to use depends on the type of parameter and the operation that needs to be performed. If you need to change the value of the parameter in the method, you need to use pass by reference. If you do not need to change the value of the parameter in the method, you can use pass by value.
]]>