Secure coding

Injection attacks refer to a broad class of attack vectors. In an injection attack, an attacker supplies untrusted input to a program. This input gets processed by an interpreter as part of a command or query. In turn, this alters the execution of that program.

In this section, we'll describe some general principles for preventing cross-site scripting vulnerabilities and ways of using various common technologies

Every command call and dynamic code generation method is a ticking bomb and must be handled accordingly.

The best way to prevent server-side template injection is to not allow any users to modify or submit new templates.

Secure coding practices prescribe that spring expressions using dynamic values should be avoided.