Secure Coding Practices

import java.util.regex.Pattern;

public class Main {
    // Allow-list validation: say what IS allowed, reject everything else.
    // A username may only contain letters, digits and underscores, 3-16 chars.
    private static final Pattern USERNAME = Pattern.compile("^[A-Za-z0-9_]{3,16}$");

    static boolean isValidUsername(String input) {
        if (input == null) return false;            // null is never valid
        return USERNAME.matcher(input).matches();   // true only if the WHOLE string matches
    }

    public static void main(String[] args) {
        String[] tries = {
            "alice_99",                                   // good
            "ab",                                         // too short
            "robert'); DROP TABLE users;--",              // SQL injection attempt
            "<script>alert(1)</script>"                   // XSS attempt
        };

        for (String t : tries) {
            // Validate at the boundary, BEFORE the value reaches a database or page.
            System.out.println(isValidUsername(t) + "  <- " + t);
        }
    }
}

true  <- alice_99
false  <- ab
false  <- robert'); DROP TABLE users;--
false  <- <script>alert(1)</script>

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.Statement;

public class Main {
    // ❌ VULNERABLE: user input is concatenated straight into the SQL text.
    static String findUserBad(Connection conn, String name) throws Exception {
        String sql = "SELECT email FROM users WHERE name = '" + name + "'";
        // If name = "' OR '1'='1", the WHERE clause is always true ->
        //   SELECT email FROM users WHERE name = '' OR '1'='1'
        // The attacker dumps EVERY row. This is SQL injection (OWASP A03).
        try (Statement st = conn.createStatement();
             ResultSet rs = st.executeQuery(sql)) {
            return rs.next() ? rs.getString("email") : null;
        }
    }

    // ✅ FIXED: the ? placeholder keeps data and code separate.
    static String findUserSafe(Connection conn, String name) throws Exception {
        String sql = "SELECT email FROM users WHERE name = ?";
        try (PreparedStatement ps = conn.prepareStatement(sql)) {
            ps.setString(1, name);   // the driver sends 'name' as DATA, never as SQL
            try (ResultSet rs = ps.executeQuery()) {
                return rs.next() ? rs.getString("email") : null;
            }
        }
        // Now "' OR '1'='1" is looked up as a literal name and simply finds nothing.
    }
}

import java.util.List;

public class Main {
    public static void main(String[] args) throws Exception {
        String filename = "report.txt; rm -rf /";   // attacker-controlled input

        // ❌ VULNERABLE: building a shell command string.
        //    Runtime.getRuntime().exec("sh -c \"cat " + filename + "\"");
        //    The shell sees the ';' and runs "rm -rf /" as a SECOND command.
        System.out.println("Bad  -> sh -c \"cat " + filename + "\"  (shell runs rm -rf /!)");

        // ✅ FIXED: no shell, and each argument is a separate list element.
        //    ProcessBuilder never interprets ';' '|' '&' — filename is ONE argument.
        ProcessBuilder pb = new ProcessBuilder(List.of("cat", filename));
        System.out.println("Good -> ProcessBuilder runs: cat [" + filename + "]");
        System.out.println("        The ';' is part of the file name, not a command.");
        // pb.start();  // would just fail to find that oddly-named file - harmless.
    }
}

Bad  -> sh -c "cat report.txt; rm -rf /"  (shell runs rm -rf /!)
Good -> ProcessBuilder runs: cat [report.txt; rm -rf /]
        The ';' is part of the file name, not a command.

import java.security.SecureRandom;
import java.util.Base64;

public class Main {
    // ❌ Math.random() is a predictable PRNG - fine for dice, NEVER for security.
    // ✅ SecureRandom is a cryptographically strong source for tokens, salts, keys.
    private static final SecureRandom RNG = new SecureRandom();

    static String newToken() {
        byte[] bytes = new byte[32];              // 32 bytes = 256 bits of entropy
        RNG.nextBytes(bytes);                     // fill with unpredictable bytes
        return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
    }

    public static void main(String[] args) {
        // Each token is unguessable - use for session IDs, password-reset links, API keys.
        System.out.println("Session token: " + newToken());
        System.out.println("Reset token:   " + newToken());

        // Math.random() returns a double in [0,1) - an attacker who sees a few
        // outputs can predict the rest. Don't build secrets on it:
        System.out.println("Math.random()  -> " + Math.random() + "  (predictable - avoid!)");
    }
}

import java.util.regex.Pattern;

public class Main {
    public static void main(String[] args) {
        // 🎯 YOUR TURN — fill in the blanks marked with ___

        // 1) Validate a 6-digit PIN. Build an allow-list regex:
        //    start ^, then a digit class, repeated exactly 6 times, then end $.
        Pattern pin = Pattern.compile(___);   // 👉 e.g. "^[0-9]{6}$"

        // 2) A safe check returns true only if the WHOLE string matches.
        String input = "1234";                // too short on purpose
        boolean ok = pin.matcher(input).___;  // 👉 replace ___ with matches()

        System.out.println("PIN valid? " + ok);

        // ✅ Expected output: PIN valid? false
        //    (Try input = "123456" and you should get: PIN valid? true)
    }
}

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;

public class Main {
    // 🎯 YOUR TURN — fill in the blanks marked with ___
    // Turn this lookup into an injection-proof query.

    static boolean login(Connection conn, String user, String pwHash) throws Exception {
        // 1) Use a ? placeholder for EACH user-supplied value - never concatenation.
        String sql = "SELECT 1 FROM users WHERE name = ___ AND pw_hash = ___";  // 👉 use ? and ?

        try (PreparedStatement ps = conn.prepareStatement(sql)) {
            // 2) Bind the values by position (1-based). user goes to the first ?.
            ps.setString(1, ___);   // 👉 bind 'user'
            ps.setString(2, ___);   // 👉 bind 'pwHash'

            try (ResultSet rs = ps.executeQuery()) {
                return rs.next();   // a row exists => credentials matched
            }
        }
        // ✅ Expected: input like "admin' --" is searched for literally and finds nothing.
    }
}

import java.security.SecureRandom;
import java.util.Base64;

public class Main {
    public static void main(String[] args) {
        // 🎯 MINI-CHALLENGE: a secure password-reset token generator
        // 1. Create ONE SecureRandom instance (reuse it - don't make a new one each call).
        // 2. Make a byte[] of length 24 and fill it with rng.nextBytes(...).
        // 3. Encode it with Base64.getUrlEncoder().withoutPadding() so it's URL-safe.
        // 4. Print the token, then print its length.
        //
        // ✅ Expected: a random ~32-char string that changes every run,
        //    e.g. "Token: 8Kf2..."  then  "Length: 32"
        //    (24 bytes Base64-encode to 32 characters.)

        // your code here
    }
}