Cursor rule

1---
2paths:
3  - "**/*.java"
4---
5# Java Security
6 
7> This file extends [common/security.md](../common/security.md) with Java-specific content.
8 
9## Secrets Management
10 
11- Never hardcode API keys, tokens, or credentials in source code
12- Use environment variables: `System.getenv("API_KEY")`
13- Use a secret manager (Vault, AWS Secrets Manager) for production secrets
14- Keep local config files with secrets in `.gitignore`
15 
16```java
17// BAD
18private static final String API_KEY = "sk-abc123...";
19 
20// GOOD — environment variable
21String apiKey = System.getenv("PAYMENT_API_KEY");
22Objects.requireNonNull(apiKey, "PAYMENT_API_KEY must be set");
23```
24 
25## SQL Injection Prevention
26 
27- Always use parameterized queries — never concatenate user input into SQL
28- Use `PreparedStatement` or your framework's parameterized query API
29- Validate and sanitize any input used in native queries
30 
31```java
32// BAD — SQL injection via string concatenation
33Statement stmt = conn.createStatement();
34String sql = "SELECT * FROM orders WHERE name = '" + name + "'";
35stmt.executeQuery(sql);
36 
37// GOOD — PreparedStatement with parameterized query
38PreparedStatement ps = conn.prepareStatement("SELECT * FROM orders WHERE name = ?");
39ps.setString(1, name);
40 
41// GOOD — JDBC template
42jdbcTemplate.query("SELECT * FROM orders WHERE name = ?", mapper, name);
43```
44 
45## Input Validation
46 
47- Validate all user input at system boundaries before processing
48- Use Bean Validation (`@NotNull`, `@NotBlank`, `@Size`) on DTOs when using a validation framework
49- Sanitize file paths and user-provided strings before use
50- Reject input that fails validation with clear error messages
51 
52```java
53// Validate manually in plain Java
54public Order createOrder(String customerName, BigDecimal amount) {
55    if (customerName == null || customerName.isBlank()) {
56        throw new IllegalArgumentException("Customer name is required");
57    }
58    if (amount == null || amount.compareTo(BigDecimal.ZERO) <= 0) {
59        throw new IllegalArgumentException("Amount must be positive");
60    }
61    return new Order(customerName, amount);
62}
63```
64 
65## Authentication and Authorization
66 
67- Never implement custom auth crypto — use established libraries
68- Store passwords with bcrypt or Argon2, never MD5/SHA1
69- Enforce authorization checks at service boundaries
70- Clear sensitive data from logs — never log passwords, tokens, or PII
71 
72## Dependency Security
73 
74- Run `mvn dependency:tree` or `./gradlew dependencies` to audit transitive dependencies
75- Use OWASP Dependency-Check or Snyk to scan for known CVEs
76- Keep dependencies updated — set up Dependabot or Renovate
77 
78## Error Messages
79 
80- Never expose stack traces, internal paths, or SQL errors in API responses
81- Map exceptions to safe, generic client messages at handler boundaries
82- Log detailed errors server-side; return generic messages to clients
83 
84```java
85// Log the detail, return a generic message
86try {
87    return orderService.findById(id);
88} catch (OrderNotFoundException ex) {
89    log.warn("Order not found: id={}", id);
90    return ApiResponse.error("Resource not found");  // generic, no internals
91} catch (Exception ex) {
92    log.error("Unexpected error processing order id={}", id, ex);
93    return ApiResponse.error("Internal server error");  // never expose ex.getMessage()
94}
95```
96 
97## References
98 
99See skill: `springboot-security` for Spring Security authentication and authorization patterns.
100See skill: `security-review` for general security checklists.
101