Security

Security is an ongoing concern in any library. Juneau is designed so that its serializers and parsers are safe by default — POJO types are inferred from the Class objects you pass in rather than from attacker-controlled input — but a few areas warrant care when you extend the framework or expose it over HTTP.

This section covers the security characteristics of each layer:

• Marshalling Security — why the parsers are not subject to arbitrary-object (demarshalling) attacks, how bean dictionaries replace open-ended class attributes, and the security posture of the dependent parsing libraries.

• SVL Security — how the Simple Variable Language guards against variable-injection and file-disclosure attacks via the Var.allowNested() / Var.allowRecurse() controls, and what to watch for when writing your own variables.

• REST Security — mitigating denial-of-service attacks through the maxInput() setting and the parsers' streaming (non-DOM) design.

• Content Security Policy — locking down Juneau's auto-generated HTML pages (HtmlDoc, Swagger UI, OpenAPI UI, widgets) with a first-class Content-Security-Policy header bean.

If you discover a security vulnerability in Juneau, please follow the responsible-disclosure instructions in SECURITY.md rather than opening a public issue.

In This Section

📄️ 7.1.1. Marshalling Security

Demarshalling vulnerabilities

📄️ 7.1.2. SVL Security

Care must be used when defining new Vars using the SVL API since mistakes

📄️ 7.1.3. REST Security

Denial of service attacks can be alleviated through the maxInput() setting.

📄️ 7.1.4. Content Security Policy

Content Security Policy (CSP) is a browser security mechanism that lets a server