Secure Java Programming

Secure
Programming for Linux and Unix HOWTO

While I tend to be quite paranoid when I develop my code, some times its
when you're churning out large amounts of code to be complacent.

For a great  insight to some do's and donts check out David Wheelers
Secure Programming.
It is mainly concerned with general Linux (C/C++) coding, but the list of
guidelines is invaluable.

For example:

5. Never return a mutable object to potentially
malicious code (since the code may decide to change it). Note that arrays
are mutable (even if the array contents aren't), so don't return a reference
to an internal array with sensitive data.

This is a pet pieve for me with normal java collections. Did I see
Jakarta's Commons Collections having a ReadOnly Decorator??? I just had a
look through their javadocs,
but couldnt find it.


The best implementation of Immutable Collections I've seen is my old
friend Tyler Close's Waterken library, that has recently been reborn as Waterken ADT. He also has
a pretty cool object db based on some of these principles as well.
If you can bear a slightly different syntax his stuff is great.

His collections are completely immutable. If you add something to a set,
you get a completely new immutable set.

    my_set = my_set.with("bob");

This is of course completely similar to what we do with Strings. It's a bit
different, but really quite cool.

I wrote a fair bit of code around his first rev a couple of years ago. Maybe
I should rediscover it and be more secure.