Secure code review by language: Java, C# and Go
You recognise dangerous patterns specific to Java, C# and Go and configuration mistakes in Spring, ASP.NET Core and Go HTTP layers, fix the flaws in code and write CodeQL queries for these languages.
Level 401 · 15 lessons · 13 practice labs
Lessons
Java
- Dangerous Java patterns: Runtime.exec, ObjectInputStream and XML factories
- Spring Security configuration mistakes
- Query safety in JPA and Hibernate
- Short task: find and fix four flaws in a Spring Boot app
C# and .NET
- Dangerous .NET patterns: BinaryFormatter, Process.Start and XmlDocument
- Identity, authorisation policies and anti-forgery in ASP.NET Core
- Razor escaping and Entity Framework raw queries
- Short task: find and fix four flaws in an ASP.NET Core app
Go
- Dangerous Go patterns: exec.Command, text/template and filepath.Join
- Middleware and authorisation mistakes in net/http and frameworks
- Concurrency bugs in Go and the race detector
- Short task: find and fix four flaws in a Go service
Rules and process
- Writing CodeQL queries for these languages
- Auditing Maven, NuGet and Go module dependencies
- Capstone: review and fix a system made of Java, C# and Go services
Practice labs
- A path open to everyone in Spring Security: Find the admin path opened to everyone by mistake in the security configuration and fix the rule.
- Concatenated JPQL in JPA: Find the JPQL query built by string concatenation and change it to named parameters.
- A Java XML factory and ObjectInputStream: Find the unsafe XML factory and object reading in the Spring Boot service, fix them with safe settings and test.
- Four flaws in a Spring Boot service: Find four flaws in the Spring Boot service by reading the code, fix them and pass the build and tests.
- Raw HTML output in Razor: Find the Razor line that writes user data as raw HTML and change it to encoded output.
- A raw query in Entity Framework: Find the raw query built with string interpolation and change it to the parameterised form.
- A missing authorisation policy in ASP.NET Core: Find the controller action missing its authorisation attribute, add a policy and verify antiforgery protection.
- Four flaws in an ASP.NET Core service: Find four flaws in the ASP.NET Core service, fix them and pass the build and tests.
- filepath.Join does not prevent traversal: Find the path traversal in a download function that trusts filepath.Join in the Go service and add a root check.
- HTML produced with text/template: Find code that uses text/template to produce HTML and move it to html/template.
- A data race in Go: Find the data race on a shared map with the race detector and fix it with synchronisation.
- A CodeQL query in three languages: Run CodeQL queries that find user input reaching command execution in the Java, C# and Go services and verify the results.
- Maven, NuGet and Go module audit: Audit the dependencies of three services, upgrade the affected versions and show the builds pass.
About this course
You recognise dangerous patterns specific to Java, C# and Go and configuration mistakes in Spring, ASP.NET Core and Go HTTP layers, fix the flaws in code and write CodeQL queries for these languages.
What you will learn
- Java
- C# and .NET
- Go
- Rules and process
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.