GB/T 34944-2017 in English
VALIDSource code vulnerability testing specification for Java
- Issued on:2017-11-01
- Implemented on:2018-05-01
- File Format:PDF
- Delivery:Via email within 5 business days
$786.00
| Standard No: | GB/T 34944-2017 |
| Document status: | VALID |
| Title in English: | Source code vulnerability testing specification for Java |
| Title in Chinese: | Java语言源代码漏洞测试规范 |
| Language: | English |
| File Format: | Electronic (PDF) |
| Delivery: | Via email within 5 business days |
| Issued on: | 2017-11-01 |
| Implemented on: | 2018-05-01 |
| ICS Classification: | 35.080-Software development and system documentation |
| Professional Classification: | GB-National Standard |
| Related Keywords: | source code vulnerability
key vulnerability technologies injection vulnerability protection sql injection example vulnerability rule standard core framework vulnerability category number |
| Related Topics: | loophole
GB/T 34944-2017 Java language source code vulnerability testing source code code tester GB/T34944-2017 gb/t34944 GBT34944 GB/T 34944-2017 JAVA language source code vulnerability testing specifications HD Pinhole test Leakage monitoring specifications gb/t 34944 pdf gb t 34944 |
《GB/T 34944-2017Java语言源代码漏洞测试规范》由TC28（全国信息技术标准化技术委员会）归口，TC28SC7（全国信息技术标准化技术委员会软件与系统工程分会）执行，主管部门为国家标准化管理委员会。
Introduction
Analysis of Standard Core Framework
| Vulnerability Category | Number of Vulnerabilities | Typical Risks | Test Focus |
|---|---|---|---|
| Behavioral Issues | 1 | Memory Resource Exhaustion | Memory Allocation Controlled by External Input |
| Data Processing | 12 | Injection Attack/Information Leakage | Input Validation and Filtering Mechanism |
| Security Function | 19 | Identity Forgery/Data Leakage | Encryption Algorithm and Authentication Mechanism |
Analysis of Key Vulnerability Technologies
1. Injection Vulnerability Protection
SQL Injection Example:Irregular usage of directly concatenating SQL statements poses a very high risk:
String query = "SELECT * FROM user_data WHERE userid = " + owner;
Standard solution:PreparedStatement parameterized query should be used:
PreparedStatement ps = con.prepareStatement("SELECT * FROM user_data WHERE userid = ?"); ps.setString(1, owner); 2. Session Security Mechanism
| Risk scenarios | Standard requirements | Implementation points |
|---|---|---|
| Session fixation attack | 5.2.7.1 | SessionID must be reset after authentication |
| Persistent session risk | 5.2.7.2 | Set a reasonable session timeout (recommended ≤30 minutes) |
Test implementation guide
1. Selection of automated testing tools
The standard recommends giving priority to the following technical indicators:
- Vulnerability rule library coverage ≥ 9 major vulnerability categories required by the standard
- False alarm rate ≤ 15% (manually verified samples)
- Support class=instrument>Checkmarx, Fortify and other mainstream tools
2. Test process management
Four-stage test model:
- Test planning: formulate vulnerability scanning strategy
- Test design: establish vulnerability detection rule set
- Test execution: automated scanning + manual verification
- Test summary: generate risk matrix report
Standard evolution analysis
This standard is based on the CWE 2.9 version vulnerability classification system and is updated synchronously with the OWASP Top 10. Main technical evolution:
- New additions in the 2017 version: API security testing requirements for microservice architecture
- Key enhancements: Detection specifications for cryptography-related vulnerabilities (such as RSA-OAEP padding requirements)
- Testing innovation: Introduction of a hybrid testing mode that combines automated tools with manual analysis
Loading PDF document...
Error loading PDF. Please make sure the file is valid and try again.
We also recommend
-
GB/T 40685-2021 in English
Information technology service—Data asset—Management requirements
2021-10-11 -
GB/T 36328-2018 in English
Information technology-Software asset management-Identification specification
2018-06-07 -
GB/T 34943-2017 in English
Source code vulnerability testing specification for C/C++
2017-11-01
