# Java/JS Secure Coding

| Language   | Insecure Function/Practice                                | Vulnerability              | Scenario                                                                                                          | Remediation/Secure Function                                                                                       |
| ---------- | --------------------------------------------------------- | -------------------------- | ----------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| Java       | `ObjectInputStream.readObject`                            | Insecure Deserialization   | A web application deserializes untrusted data from user input, leading to remote code execution.                  | Use a safe deserialization library like `Gson` or `Jackson`, validate and sanitize input, use `ObjectInputFilter` |
| Java       | `PreparedStatement` without parameterized queries         | SQL Injection              | A web application constructs SQL queries using user input without parameterized queries.                          | Use parameterized queries with `PreparedStatement`                                                                |
| Java       | `request.getParameter` without validation                 | Cross-Site Scripting (XSS) | A web application directly outputs user input in the HTML response.                                               | Validate and encode user input using libraries like `ESAPI` or `OWASP Java Encoder`                               |
| Java       | `HttpServletRequest.getSession` without secure attributes | Session Fixation           | A web application does not set the `HttpOnly` and `Secure` attributes on session cookies.                         | Set `HttpOnly` and `Secure` attributes on session cookies                                                         |
| Java       | Logging sensitive information                             | Information Exposure       | Sensitive information like passwords or tokens is logged.                                                         | Avoid logging sensitive information, use redaction if necessary                                                   |
| Java       | Unrestricted file upload                                  | Unrestricted File Upload   | A web application allows users to upload files without validation, leading to remote code execution.              | Validate file types, use a whitelist of allowed file types, scan for malicious content                            |
| JavaScript | Direct DOM manipulation with user input                   | Cross-Site Scripting (XSS) | A web application directly injects user input into the DOM.                                                       | Use innerText or textContent instead of innerHTML, validate and encode user input                                 |
| JavaScript | `eval` with user input                                    | Code Injection             | A web application executes user input as code using `eval`.                                                       | Avoid using `eval`, use safer alternatives like `JSON.parse` for parsing JSON data                                |
| JavaScript | `localStorage` for sensitive data                         | Sensitive Data Exposure    | Sensitive data like tokens or passwords is stored in `localStorage`.                                              | Store sensitive data in secure, HTTP-only cookies                                                                 |
| JavaScript | `setTimeout` and `setInterval` with string arguments      | Code Injection             | A web application uses `setTimeout` or `setInterval` with user input as a string.                                 | Use function expressions instead of string arguments                                                              |
| JavaScript | Insecure object property access                           | Prototype Pollution        | A web application merges user input into objects without validation.                                              | Validate and sanitize input before merging it into objects                                                        |
| JavaScript | `innerHTML` with user input                               | Cross-Site Scripting (XSS) | A web application uses `innerHTML` to inject user input into the DOM.                                             | Use innerText or textContent instead of innerHTML, validate and encode user input                                 |
| JavaScript | Unrestricted file upload                                  | Unrestricted File Upload   | A web application allows users to upload files without validation, leading to potential XSS or malware injection. | Validate file types, use a whitelist of allowed file types, scan for malicious content                            |