01 · Learn
What's a security bug?
A bug is a mistake in a program. It becomes a security bug when someone can exploit it to get access or powers they shouldn't have.
The 8 kinds · tap one
Bug #1
Path traversal
The app sticks your input onto the end of a folder path. Type ../ and you walk right out of that folder.
1234.txtstays inside ✓../demoPlan.txtclimbs out ✗Try the attack yourself
The program reads files from Downloads/ and runs with sudo.
How to stop it
- 1
Validate user input before touching any file.
- 2
Canonicalize, then check.
getCanonicalPath()turns the path into its real form (no..). Then make sure it still starts with your folder. - 3
Use libraries like
java.nio.file.Pathor Apache Commons IOFilenameUtils.
💡 Order matters. If you check the raw text first, tricks like %2e%2e%2f or symlinks can sneak past.
Bug #2
Integer overflow
Every number type has a ceiling. Go past it and Java doesn't complain. The number just wraps around to the bottom, like an old car odometer.
A Java short can hold −32,768 to 32,767
Press +1 and watch what happens at the top.
The lab's pay calculator
It works out salary + period × increment and stores it in a short.
How to stop it
- 1
Pick a big enough type. Use
intorlonginstead ofshort. - 2
Check the range before you calculate, and show an error instead of a wrong number.
- 3
Use safe maths.
Math.addExactandMath.multiplyExactthrow an error instead of wrapping.
All the integer sizes +
| Type | Bits | Range |
|---|---|---|
| byte | 8 | −128 … 127 |
| short | 16 | −32,768 … 32,767 |
| int | 32 | −2,147,483,648 … 2,147,483,647 |
| long | 64 | about ±9.2 × 10¹⁸ |
Quick recap
- 🔓 A security bug is a bug someone can exploit.
- 📂 Path traversal:
../escapes the folder. Canonicalize, then check. (CERT IDS02-J) - 🔢 Integer overflow: numbers wrap silently. Bigger type, range check,
Math.*Exact. (CERT NUM00-J) - 🪜 Privilege escalation: using a program's extra powers (like
sudo) to reach things you shouldn't.
02 · Lab
Do the lab
One task at a time. Tick steps as you go; your ticks are saved on this device.
📥 First: download Welcome.zip, Demo-1.zip, Demo-2.zip, Chapter-2.pdf and Chapter-5.pdf from Blackboard › Week-7 › Resource into /home/student/Downloads.
1 Set up Java and EclipseInstall, set JAVA_HOME, build a JAR ⌄
Install Java, the JDK and Eclipse
$ sudo apt update $ sudo apt install default-jre $ sudo apt install default-jdk $ sudo apt install snapd $ sudo snap install --classic eclipse
Open Eclipse once, then close it
Use workspace /home/student/eclipse-workspace.
Find where Java lives
$ sudo update-alternatives --config java … (providing /usr/bin/java): /usr/lib/jvm/java-11-openjdk-amd64/bin/java
Copy the yellow path. Your version number may differ.
Set JAVA_HOME
$ sudo nano /etc/environment # add this new line, then Ctrl+O, Enter, Ctrl+X JAVA_HOME="/usr/lib/jvm/java-11-openjdk-amd64/bin/java" $ source /etc/environment
Put the Welcome project in the workspace
$ cd /home/student/Downloads $ sudo cp Welcome.zip /home/student/eclipse-workspace/ $ cd /home/student/eclipse-workspace/ $ unzip Welcome
In Eclipse: File › New › Java Project, name it Welcome, click Finish
Same name as the folder, so Eclipse finds the code.
Show screenshots
Delete module-info.java
Right-click it under Welcome › src and choose Delete.
Show screenshots
→
Press the green ▶ Run button once
This creates the “Main - Welcome” launch configuration that the export needs.
Right-click Welcome › Export › Java › Runnable JAR file
Launch config: Main - Welcome. Destination: /home/student/welcome.jar. Then Finish.
Show screenshots
Run it 🎉
$ cd /home/student $ java -jar welcome.jar Type your name: Rana Rana, it's a pleasure to welcome you to our lecture today…
2 Attack: path traversalRead a file you shouldn't be able to ⌄
Unzip Demo-1 and move the secret file up one folder
$ cd /home/student/Downloads $ unzip Demo-1 $ mv demoPlan.txt /home/student/
Lock it so only root can read it
$ cd /home/student/ $ sudo chmod 700 demoPlan.txt $ sudo chown root demoPlan.txt $ cat demoPlan.txt cat: demoPlan.txt: Permission denied # good, it's locked
Use the program normally
$ cd /home/student/Downloads/ $ sudo java -jar IDS02-J.jar Enter the file name (e.g. customerID.txt): 1234.txt Email: "johnfoo@gmail.com" …
Now attack it with ../
$ sudo java -jar IDS02-J.jar Enter the file name (e.g. customerID.txt): ../demoPlan.txt Create a central repository of core assets Conduct a BIA on key business functions …
You just read a locked file. The program has sudo power and never checks where the path goes. That's path traversal and privilege escalation.
3 Fix: path traversal submitCERT IDS02-J · canonicalize, then check ⌄
Read Chapter-2.pdf, pages 36–40
Unzip IDS02-J.zip into the workspace and open it in Eclipse
Same as Task 1: New Java Project with the folder's name.
Find where the typed file name becomes a File
Canonicalize the path and reject anything outside Downloads
Re-export and test: 1234.txt works, ../demoPlan.txt is blocked
Stuck? Peek at a model solution
Tap to unblur. Real names in the zip may differ.
File base = new File("/home/student/Downloads"); File file = new File(base, fileName); String safeBase = base.getCanonicalPath() + File.separator; String realPath = file.getCanonicalPath(); // removes ".." and "." if (!realPath.startsWith(safeBase)) { System.out.println("Access denied: invalid file name."); return; } // safe to open realPath now
4 Attack: integer overflowGet a negative salary ⌄
Unzip Demo-2 and try small numbers
$ cd /home/student/Downloads $ unzip Demo-2 $ java -jar NUM00-J.jar Salary: 5000 Increment: 200 Period: 15 Total Payable = 8000 # correct
Now go over 32,767
$ java -jar NUM00-J.jar Salary: 32000 Increment: 3000 Period: 2 Total Payable = -27536 # should be 38000!
Why? 38,000 doesn't fit in a short, so it wraps: 38,000 − 65,536 = −27,536.
5 Fix: integer overflow submitCERT NUM00-J · detect or prevent it ⌄
Read Chapter-5.pdf, pages 106–113
Unzip NUM00-J.zip into the workspace and open it in Eclipse
Find the short variables and the calculation
Fix it: bigger type, range check or Math.*Exact
Test 32000 · 3000 · 2: you get 38000 or a clear error
Stuck? Peek at a model solution
Tap to unblur. Real names in the zip may differ.
int salary = sc.nextInt(); // int instead of short int increment = sc.nextInt(); int period = sc.nextInt(); try { int total = Math.addExact(salary, Math.multiplyExact(period, increment)); System.out.println("Total Payable = " + total); // 38000 } catch (ArithmeticException e) { System.out.println("Error: number too large"); }
✉ Hand it inTasks 3 and 5 to your tutor ⌄
Email your fixed code and test screenshots for Tasks 3 and 5
Use this subject (the old sheet's screenshot says LAB1, that's a typo):
03 · Quiz