/catalog/296695a3fdd74f71b4ced1996c9b6856//Document/521742111748165.html/Document/521740472320069.html/Document/520680288002117.html/Document/520679709044805.html/Document/520421404913733.html/Document/520420916084805.html/Document/519695556915269.html/Document/519695178637381.html/Document/519286084939845.html/Document/519285550596165.html/Document/517527679774789.html/Document/517527163703365.html/Document/512185975087173.html/Document/511946871631941.html/Document/511946429853765.html/Document/510490688409669.html/Document/510490145665093.html/Document/509474966245445.html/Document/509474292002885.html/Document/508381305012293.html/Document/508380165513285.html/Document/507942179053637.html/Document/507941613613125.html/Document/507336815288389.html/Document/507336323162181.html/Document/506969107042373.html/Document/506968450326597.html/Document/505888177782853.html/Document/505887157772357.html/Document/505549163270213.html/Document/505548496027717.html/Document/505143668654149.html/Document/505143105032261.html/Document/504503398395973.html/Document/504502746468421.html/Document/503017040437317.html/Document/503016609853509.html/Document/502718247415877.html/Document/502717705343045.html/Document/502361750245445.html/Document/502361307697221.html/Document/501990556381253.html/Document/501989827113029.html/Document/500880675987525.html/Document/500880224911429.html/Document/500250144956485.html/Document/500232490541125.html/Document/499908522852421.html/Document/499907986919493.html/Document/498447282262085.html/Document/498446788378693.html/Document/498103952822341.html/Document/498103476068421.html/Document/497705815789637.html/Document/497703055208517.html/Document/497352259182661.html/Document/497351210856517.html/Document/496977382301765.html/Document/496976846573637.html/Document/495934617931845.html/Document/495933266260037.html/Document/495577945600069.html/Document/495576688218181.html/Document/494873100378181.html/Document/494872714567749.html/Document/494515031642181.html/Document/494514507194437.html/Document/492829277941829.html/Document/492826934538309.html/Document/492478892306501.html/Document/492478432673861.html/Document/492048771612741.html/Document/492048321876037.html/Document/491018538238021.html/Document/491017994391621.html/Document/490617591144517.html/Document/490616589226053.html/Document/490277546360901.html/Document/490277081866309.html/Document/488480491106373.html/Document/488479777673285.html/Document/488131539537989.html/Document/488129496956997.html/Document/487787449102405.html/Document/487786620837957.html/Document/487425698246725.html/Document/487425161941061.html/Document/487077007417413.html/Document/487076470157381.html/Document/486012783796293.html/Document/486011843792965.html/Document/485654058504261.html/Document/485653628149829.html/Document/485285488848965.html/Document/485005121204293.html/Document/485004810907717.html/Document/483634668224581.html/Document/483162688110661.html/Document/482456439619653.html/Document/480691329347653.html/Document/479981549019205.html/Document/479640516874309.html/Document/478581868011589.html/Document/478211995488325.html/Document/477860005101637.html/Document/477516631253061.html/Document/476091023597637.html/Document/475748190408773.html/Document/475747825885253.html/Document/475390229778501.html/Document/475389762682949.html/Document/475021811523653.html/Document/475021482278981.html/Document/474681074966597.html/Document/474680715309125.html/Document/473641910472773.html/Document/473641599152197.html/Document/472917246013509.html/Document/472916949708869.html/Document/472553316364357.html/Document/472553009672261.html/Document/472222551654469.html/Document/472222166081605.html/Document/470772911669317.html/Document/470772523974725.html/Document/470491812298821.html/Document/470491020734533.html/Document/470144418017349.html/Document/470144062480453.html/Document/469355727437893.html/Document/469355344896069.html/Document/469002772238405.html/Document/469002372866117.html/Document/465854760509509.html/Document/465854252036165.html/Document/465481503801413.html/Document/465481068789829.html/Document/465193214992453.html/Document/465192312610885.html/Document/464860703494213.html/Document/464860235079749.html/Document/463357444149317.html/Document/463351258955845.html/Document/462989079121989.html/Document/462988335923269.html/Document/462660239003717.html/Document/462658920042565.html/Document/461304163098693.html/Document/461301616328773.html/Document/460881708830789.html/Document/460876803891269.html/Document/460520743743557.html/Document/460513554071621.html/Document/460169107955781.html/Document/460168465489989.html/Document/459825920966725.html/Document/459825340420165.html/Document/458389364535365.html/Document/458388990779461.html/Document/458052748820549.html/Document/458051490840645.html/Document/457785747443781.html/Document/457785205239877.html/Document/457346283610181.html/Document/457345117622341.html/Document/456266454548549.html/Document/456265627877445.html/Document/455911269912645.html/Document/455557920325701.html/Document/455557492965445.html/Document/455218049572933.html/Document/454857812234309.html/Document/453789017641029.html/Document/453449959817285.html/Document/453079570784325.html/Document/452403319308357.html/Document/451310486503493.html/Document/450994786713669.html/Document/450345001971781.html/Document/449962449588293.html/Document/448929358094405.html/Document/448230949081157.html/Document/447863453311045.html/Document/446102887440453.html/Document/445725270851653.html/Document/445022107115589.html/Document/443641819930693.html/Document/443271687684165.html/Document/443270796382277.html/Document/443270370861125.html/Document/441430268338245.html/Document/441419688190021.html/Document/441419056222277.html/Document/440429294637125.html/Document/438340763410501.html/Document/437986291200069.html/Document/437603819495493.html/Document/436191615103045.html/Document/435855229702213.html/Document/435147718438981.html/Document/434051877818437.html/Document/433366954807365.html/Document/432997464641605.html/Document/432628688769093.html/Document/432266670596165.html/Document/430907430723653.html/Document/428784032424005.html/Document/428385797652549.html/Document/428062862630981.html/Document/427712386293829.html/Document/426283111870533.html/Document/424188637298757.html/Document/423430430916677.html/Document/422738450387013.html/Document/421335462469701.html/Document/420956089200709.html/Document/420244068835397.html/Document/419142595375173.html/Document/418879737671749.html/Document/418156051357765.html/Document/417780141715525.html/Document/416729842651205.html/Document/416373677670469.html/Document/416014651207749.html/Document/414600654966853.html/Document/414232150913093.html/Document/413894034452549.html/Document/411749575036997.html/Document/411444007235653.html/Document/410989555187781.html/Document/410365315555397.html/Document/408937260335173.html/Document/408592682856517.html/Document/408239118336069.html/Document/402940329152581.html/Document/401521045061701.html/Document/401149456379973.html/Document/400819542675525.html/Document/400464907001925.html/Document/399363703992389.html/Document/399019061391429.html/Document/398327264952389.html/Document/397988956139589.html/Document/396547962679365.html/Document/396188926316613.html/Document/395839580831813.html/Document/395509538283589.html/Document/393696815161413.html/Document/393356444545093.html/Document/393008819511365.html/Document/391891180220485.html/Document/391256916983877.html/Document/390918744105029.html/Document/390528820486213.html/Document/389136971677765.html/Document/388763822231621.html/Document/388416565977157.html/Document/388045527777349.html/Document/386637062586437.html/Document/386290355249221.html/Document/386290343432261.html/Document/385922848862277.html/Document/384498574901317.html/Document/384178599956549.html/Document/383813990293573.html/Document/383450832826437.html/Document/383112784425029.html/Document/381983009394757.html/Document/381676021035077.html/Document/381338668412997.html/Document/380973198676037.html/Document/380625301606469.html/Document/376028059926597.html/Document/374587749163077.html/Document/374252417724485.html/Document/373905092177989.html/Document/373540837523525.html/Document/373226847809605.html/Document/311601443917893.html/Document/311285189517381.html/Document/310134890274885.html/Document/309794452426821.html/Document/309507604934725.html/Document/304898482892869.html/Document/304549706600517.html/Document/304188584996933.html/Document/303818784497733.html/Document/302700517105733.html/Document/302416475320389.html/Document/302077848256581.html/Document/301288627347525.html/Document/300279638184005.html/Document/274792263872581.html/Document/273024381308997.html/Document/272683642789957.html/Document/272351623921733.html/Document/271961406242885.html/Document/271560844214341.html/Document/270477420015685.html/Document/269881559916613.html/catalog/c51244b85e704db9a2a34ca396e9fe27//Document/375674108960837.html/Document/340619525128261.html/Document/340263572500549.html/Document/337103780888645.html/Document/336726028042309.html/Document/336395351863365.html/Document/336019384291397.html/Document/334605603291205.html/Document/334264344903749.html/Document/333908786077765.html/Document/333537608929349.html/Document/332422937043013.html/Document/323979240091717.html/Document/323624591507525.html/Document/322518056206405.html/Document/322224629981253.html/Document/321870777405509.html/Document/321154810175557.html/Document/319738524639301.html/Document/319395521761349.html/Document/319038449188933.html/Document/318684198744133.html/Document/317575537291333.html/Document/316584392339525.html/Document/297463116619845.html/Document/296410729726021.html/Document/294281412902981.html/Document/289614801383493.html/Document/289336711553093.html/Document/288989717336133.html/Document/267736666357829.html

安全测试国家标准解读——面向对象程序安全

下面的系列文章主要围绕《GB/T 38674—2020 信息安全技术 应用软件安全编程指南》进行讲解,该标准是2020年4月28日,由国家市场监督管理总局、国家标准化管理委员会发布,2020年11月01日开始实施。我们对该标准中一些常见的漏洞进行了梳理,大家感兴趣的话可以自己去下载下来学习一下,里面有一些最佳实践是比较好的。

 

本标准从程序安全和环境安全两个方面提出了提升应用安全性的编程最佳实践。其中,程序安全部分描述软件在资源使用、代码实现、安全功能方面的安全性规范,环境安全部分描述软件的安全管理配置规范。前面的文章为大家介绍了程序安全,本文我们针对代码安全的面向对象程序安全部分进行解读。

代码安全实现内容

代码安全的实现主要包括:面向对象程序安全、并发程序安全、函数调用安全、异常处理安全、指针安全、代码生成安全。
这几块对于开发人员来说都是经常遇到的,我们在代码审计的过程中也会经常遇到,这应该算是规范性的一些问题。经过不断的实践积累也可以形成一个代码的安全编程规范,让整个项目组按照这个规范进行编程,从源头上规避安全问题。

java编程规范

阿里巴巴也曾经发布过一个java的编程规范,写得非常详细,都能具体到使用哪一个类是比较安全的,大家感兴趣可以下载下来看一看。

【面向对象程序安全】
1.子类对基类的扩展需从以下角度进行安全控制:
(1)对基类的扩展,应保持由基类提供的不变性。
(2)对于关键基类仅允许受信任的子类进行扩展。
这条主要是针对java语言,主要是一个编程规范,这块我们也不展开说了,就是一个最基本的安全要求。
2.禁止返回类的私有可变成员的引用。可返回一个指向内部可变成员的防御性副本的引用,从而保护内部状态不会被非预期地修改。
这条是说类里面的私有可变成员尽量不要直接返回,尽量通过方法的方式返回一个副本,比如get、 set这些方式。给它赋个值,再返回来,不要直接返回成员变量。
3.对可变变量(或可变的内部对象)创建防御性副本:
(1)如果程序逻辑依赖可变变量,则需警惕竞态攻击。
(2)在需要访问可变变量(或可变的内部对象)时,可使用返回可变变量(或可变的内部对象)的封装器方法来实现。
4.当判定一个对象是否属于特定的类,或两个对象的类是否相同时,比较类对象,而非仅基于类名称进行判定。
因为类的名称有一些是可以被篡改的,黑客在攻击的时候会生成一个一样的类名,但是类的内容是不一样的,所以在比较的时候通过类的对象或类的方法进行比较。

后面的文章会继续对《GB/T 38674—2020 信息安全技术 应用软件安全编程指南》的其他部分进行解读,欢迎继续关注。