Snyk on foojay.io - Friends of OpenJDK

What is RAG, and How to Secure It

Fri, 16 May 2025 11:48:16 +0000

Integrating large language models (LLMs) into your application is more accessible than ever. With a few API calls to OpenAI, Anthropic, or Cohere, you can instantly add ++AI capabilities++ to your stack. Using frameworks and libraries that abstract this away for you makes it even easier to create your own LLM-powered assistant. However, if you’ve shipped any real-world LLM features, you’ve hit the wall where these powerful models confidently make up facts, reference outdated information, or deliver answers that don’t take your context into account.

Creating SBOMs with the Snyk CLI

Fri, 07 Mar 2025 12:25:36 +0000

The software bill of materials (SBOM) is quickly becoming an essential aspect of open source security and compliance. In this post, we’ll delve into what SBOMs are, why they’re necessary, and their role in open source security.

What are SBOMs?

A software Bill of Materials (SBOM) is a comprehensive inventory of all components used in a software product. They include all the necessary details about each component, such as their names, versions, and licensing information. SBOMs can be seen as the ingredients list for software, providing complete transparency into what makes up a software product.

The Persistent Threat: Why Major Vulnerabilities Like Log4Shell and Spring4Shell Remain Significant

Tue, 17 Sep 2024 16:17:07 +0000

This article was originally published at Snyk.io

As developers, we’re constantly juggling features, fixes, and deadlines. Yet, a lurking issue has been surprisingly overlooked: the continued use of vulnerable Log4j and Spring Framework versions in many projects.

Despite the high-profile exposure of Log4Shell and Spring4Shell vulnerabilities, a shocking number of applications are still running on these ticking time bombs. This isn’t just a minor oversight — it’s a major risk. We’re builders at heart, but part of building is ensuring our structures are safe.

Four Easy Ways to Analyze your Java and Kotlin Code for Security Problems

Fri, 30 Aug 2024 09:07:43 +0000

Originally published at Snyk.io .

Nowadays, the security of your applications is just as important as the functionality they provide. Therefore, analyzing your code for security vulnerabilities is a vital part of maintaining the integrity of your applications and protecting your users’ data. As developers, we are at the front lines of this battle. It’s our responsibility to ensure that the code we write is not just functional and efficient but also secure.

Securing Symmetric Encryption Algorithms in Java

Fri, 29 Dec 2023 05:53:50 +0000

In our connected world, securing digital data has become an utmost priority. With the wide spread of Java applications in various sectors, from banking to healthcare, we must emphasize the importance of encryption. Encryption is converting readable data or plaintext into unreadable data or ciphertext, ensuring that even if encrypted data is intercepted, it remains inaccessible to unauthorized individuals.

The first choice you must make as a developer is whether you need encryption. Although this sounds like a strange question, the key principle of encryption is that the ciphertext can be reverted into the original text.

Handling security vulnerabilities in Spring Boot

Fri, 22 Dec 2023 14:59:10 +0000

In the world of software development, managing dependencies is a core part of creating strong and secure applications. Spring Boot, a favorite among Java developers, makes building applications easier, but there’s more to it than meets the eye. Keeping your dependencies in check is crucial to ensure that your Spring Boot projects run smoothly and remain resilient in the face of ever-evolving threats.

One critical aspect of Spring Boot dependency management is security. Software vulnerabilities are discovered frequently, and by keeping your project’s dependencies up to date, you’re essentially putting on your digital security armor. Outdated dependencies can be like unlocked doors, inviting trouble from potential threats, and that’s something we’d like to avoid.

Using JLink to create smaller Docker images for Spring Boot apps

Thu, 21 Sep 2023 11:33:05 +0000

Containers bring new flexibility and agility to software development and deployment. However, they also introduce a new attack surface that malicious actors can exploit. A compromised container can give an attacker access to other containers and even the host system. Smaller images that contain fewer artifacts are already a great help in achieving a smaller attack surface.

In this article, we’ll present an in-depth exploration of utilizing JLink to optimize Docker image sizes, enhancing application security and performance. We’ll showcase how to use JLink and integrate it with Docker to efficiently deploy your Spring Boot or general Java applications.

SnakeYaml 2.0: Solving the unsafe deserialization vulnerability

Thu, 20 Jul 2023 07:17:16 +0000

In December of last year, we reported ++CVE-2022-1471++ to you. This unsafe deserialization problem could easily lead to arbitrary code execution under the right circumstances.

In the deep-dive blog post “++Unsafe deserialization vulnerability in SnakeYaml (CVE-2022-1471)++ ”, I explained the problems in this library and how it could be executed. The gist of the problem was that by default SnakeYaml parsed the incoming yaml to the generic object type.

Preventing Cross-Site Scripting (XSS) in Java with Snyk Code

Fri, 09 Jun 2023 15:23:39 +0000

Java is a powerful backend programming language that can also be used to write HTML pages for web applications. However, developers must know the potential security risks associated with Cross-Site Scripting (XSS) attacks when creating these pages.

With the rise of modern templating frameworks, preventing security attacks through proper input validation and encoding techniques has become easier.

However, when developers choose to create their own HTML pages without using a templating framework, there is an increased risk of introducing vulnerabilities.

Using Bots to Keep Dependencies Updated

Mon, 27 Mar 2023 15:18:33 +0000

Any real world Java project will likely use external dependencies.

As we’ve seen over the last few years, it’s important to keep these dependencies up to date. We used to have to manually check for updates, but fortunately these days there are tools available that can help us with this. Because, let’s be honest, most developers don’t enjoy maintaining applications.

We’d much rather be using cool new tools and/or language features, and solving interesting problems. Sorry, I mean: delivering business value! But we are responsible for keeping our dependencies up to date, so let’s make that as easy as possible.

Mitigating Path Traversal Vulnerabilities in Java

Fri, 24 Mar 2023 07:57:06 +0000

Path traversal is a type of security vulnerability that can occur when a web application or service allows an attacker to access server files or directories that are outside the intended directory structure.

This can lead to the unauthorized reading or modification of sensitive data.

In the context of file uploads, a path traversal vulnerability can occur when an application fails to properly validate the file path specified by the user, which can allow the attacker to upload a malicious file with a filename that gives them access to restricted files on the server.

How to create SBOMs in Java with Maven and Gradle

Fri, 17 Mar 2023 09:08:28 +0000

When building applications in Java, we highly depend on external libraries and frameworks. And each Java package that is imported likely also depends on more libraries. This means that the amount of Java packages included in your application is often not really transparent.

As a developer, these nested (transitive) dependencies create the problem that you probably do not know all the libraries you are actually using.

Recently, we discussed why and how we should maintain our dependencies carefully. In the article Best practices for managing Java dependencies , I discussed the options and tools available for setting up a dependency management strategy.

Best Practices for Managing Java Dependencies

Thu, 15 Sep 2022 08:21:10 +0000

Creating Java applications is great, and many resources are available.

To speed up development, many folks use frameworks and libraries that do some of the heavy lifting.

When looking at modern Java applications, almost all of them contain dependencies from libraries developed by someone else.

Dependencies take up about 80 to 90 percent of the binary — so, we should take good care of them when creating a Java project.

Secure CI/CD Pipelines with GitHub Actions for Your Java Apps

Thu, 11 Aug 2022 06:28:38 +0000

This article was originally post atSnyk.io and is used with permission

GitHub Actions has made it easier than ever to build a secure continuous integration and continuous delivery (CI/CD) pipeline for your GitHub projects.

By integrating your CI/CD pipeline and GitHub repository, GitHub Actions allows you to automate your build, test, and deployment pipeline.

You can create workflows that build and test every pull request to your repository or deploy merged pull requests to production.

How Social Trends Help Me Fix Essential Vulnerabilities

Thu, 04 Nov 2021 14:14:55 +0000

Recently, Snyk added social trends to its vulnerability data . This new indicator shows you what vulnerabilities are trending so you can better prioritize remediation. Our research team found a strong correlation between socially trending vulnerabilities and the existence of exploits that can actually harm your application.

Following the social trends of security vulnerabilities makes practical sense. When a specific vulnerability is gaining a lot of interest in social — Twitter, for instance — it means a lot of people are aware of the problem. Statistically, this also means more people that want to do you harm. Therefore, it can be important to put some extra focus on the vulnerabilities in your system that are socially trending.

Getting Started with Snyk for Secure Java Development

Thu, 29 Jul 2021 06:39:02 +0000

If you’re a Java developer who wants to develop your applications more securely, you’ve come to the right place. Snyk can help you with that mission.

This article will explain how to begin with Snyk for secure Java development so you can be more secure from the get-go.

If you’re new to Snyk, it’s important to know that we offer a variety of developer-focused products and tools. Some of these tools, like our CLI and some IDE integration, support multiple products. However, we can distinguish four different products within Snyk:

Fix Java Security Issues While Coding in IntelliJ IDEA

Thu, 29 Apr 2021 17:10:33 +0000

Nowadays, developers are responsible for more than just creating the application. Besides working on features, developers have to focus on their applications’ maintainability, scalability, reliability, and security. Many developers are unsure of where to start with security. In addition, most companies still work with a dedicated security team instead of having security expertise inside the team.

A lot of developers practically live in their integrated development environment (IDE). A good IDE is like a swiss army knife: it is your go-to tool to do almost everything. Having everything I need to build, run, test, debug, andsecure my application, makes a good IDE invaluable for many developers.