{"id":17925269,"url":"https://github.com/righettod/code-snippets-security-utils","last_synced_at":"2025-08-31T14:41:48.615Z","repository":{"id":241940211,"uuid":"805351397","full_name":"righettod/code-snippets-security-utils","owner":"righettod","description":"Provides different utilities methods to apply processing from a security perspective.","archived":false,"fork":false,"pushed_at":"2024-10-21T06:28:13.000Z","size":17728,"stargazers_count":5,"open_issues_count":2,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-10-21T09:20:20.987Z","etag":null,"topics":["appsecurity","code-snippets","java","security"],"latest_commit_sha":null,"homepage":"https://righettod.github.io/code-snippets-security-utils/","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/righettod.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-24T11:50:30.000Z","updated_at":"2024-10-21T06:28:10.000Z","dependencies_parsed_at":"2024-10-21T09:24:06.590Z","dependency_job_id":null,"html_url":"https://github.com/righettod/code-snippets-security-utils","commit_stats":null,"previous_names":["righettod/code-snippets-security-utils"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/righettod%2Fcode-snippets-security-utils","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/righettod%2Fcode-snippets-security-utils/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/righettod%2Fcode-snippets-security-utils/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/righettod%2Fcode-snippets-security-utils/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/righettod","download_url":"https://codeload.github.com/righettod/code-snippets-security-utils/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245204482,"owners_count":20577358,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["appsecurity","code-snippets","java","security"],"created_at":"2024-10-28T20:53:16.578Z","updated_at":"2025-08-31T14:41:48.604Z","avatar_url":"https://github.com/righettod.png","language":"Java","readme":"[![Dependabot Updates](https://github.com/righettod/code-snippets-security-utils/actions/workflows/dependabot/dependabot-updates/badge.svg?branch=main)](https://github.com/righettod/code-snippets-security-utils/actions/workflows/dependabot/dependabot-updates) [![Test](https://github.com/righettod/code-snippets-security-utils/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/righettod/code-snippets-security-utils/actions/workflows/test.yml) ![MadeWithIntelliJ](https://img.shields.io/static/v1?label=Made%20with\u0026message=Intellij%20IDEA%20Community%20Edition\u0026color=000000\u0026?style=for-the-badge\u0026logo=intellijidea) ![MadeWithMaven](https://img.shields.io/static/v1?label=Made%20with\u0026message=Maven\u0026color=C71A36\u0026?style=for-the-badge\u0026logo=apachemaven) ![AutomatedWith](https://img.shields.io/static/v1?label=Automated%20with\u0026message=GitHub%20Actions\u0026color=blue\u0026?style=for-the-badge\u0026logo=github) ![TargetJDK](https://img.shields.io/static/v1?label=Tested%20with\u0026message=Java%20OpenJDK%2021\u0026color=00AA13\u0026?style=for-the-badge\u0026logo=openjdk)\n\n# Description\n\n\u003e [!NOTE]\n\u003e Java was chosen but the ideas behind the proposed code can be applied to other languages.\n\n💻This project provides different utilities methods to apply processing from a defensive security perspective. These code snippet:\n\n* Can be used, as \"foundation\", to customize the validation to the app context.\n* Were implemented in a way to facilitate adding or removal of validations depending on usage context.\n* Were centralized into [one class](src/main/java/eu/righettod/SecurityUtils.java) to be able to enhance them across time as well as handle missing case/bug.\n\n🔬I uses it, as a sandbox, to create/test/provide remediation code proposals when I perform web assessment or secure code review activities.\n\n# Disclaimer\n\n\u003e [!CAUTION]\n\u003e I do not claim (and will never claim) that the proposed code is 100% effective, these are simply practical tests of ideas regarding security issues I have encountered.\n\n📍The project will not be deployed, as an artefact, into the Maven repository or the GitHub Package repository because the code provided is intended to be tailored to the business and technical context\nof the\napplication.\n\n# Tips for validating file contents\n\n\u003e [!NOTE]\n\u003e The tips and code snippets provided enrich the advices provided by the [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html).\n\n```mermaid\nflowchart TB\n    A[File received] --\u003e B(\"🔬Call corresponding isXXXSafe() methods\")\n    B --\u003e C{🤔File is safe?}\n    C --\u003e|No| E[❌File rejected]\n    C --\u003e|Yes| D(\"🔬Call sanitizeFile() methods\")\n    D --\u003e F{🤔Exception occur?} \n    F --\u003e|Yes| E\n    F --\u003e|No| G[✅File accepted]\n```\n\n# Content \u0026 conventions\n\n📝Code is centralized into the class [SecurityUtils](src/main/java/eu/righettod/SecurityUtils.java).\n\n🧪Unit tests are centralized into the\nclass [TestSecurityUtils](src/test/java/eu/righettod/TestSecurityUtils.java).\n\n📖Conventions used:\n\n* One utility methods in **SecurityUtils** class is associated to one unit test methods in **TestSecurityUtils** class: Both with the same name.\n* All tests data are stored into the [resources](src/test/resources) folder of the test area.\n* Each utility methods have a single goal and is fully documented in terms of usage as well as Internet references used.\n\n# Documentation\n\nThe javadoc of the class **SecurityUtils** is exposed [here](https://righettod.github.io/code-snippets-security-utils).\n\n# Usage\n\n👨‍💻The repository can be open directly into [Intellij IDEA](https://www.jetbrains.com/idea/download).\n\n💻Maven command to run all the unit tests:\n\n```shell\n$ mvn clean test\n[INFO] ------------------------------------------------\n[INFO]  T E S T S\n[INFO] ------------------------------------------------\n[INFO] Running eu.righettod.TestSecurityUtils\n[INFO] Tests run: 8, Failures: 0, Errors: 0, Skipped: 0\n```\n\n# Misc\n\n* https://github.com/marchof/the-missing-javadoc-fonts\n\n\n\n\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frighettod%2Fcode-snippets-security-utils","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frighettod%2Fcode-snippets-security-utils","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frighettod%2Fcode-snippets-security-utils/lists"}