Feeds

Aspect-oriented programming and security

Working together

Security for virtualized datacentres

What's even better is that I now have a central piece of code that I can change easily. For instance, suppose I find that my particular white-list is vulnerable to a newly-discovered form of XSS, then I can modify the list in one place and have it automatically propagate. Moreover, if I find other parts of my code are vulnerable to the same XSS, I simply define additional pointcuts and I'll quickly be defending against those attacks as well. In addition, if I find there are several different white lists that I need in my application (e.g. one that accepts only alpha, one that accepts alphanumeric, etc.) then I can define multiple regular expressions within the same aspect.

There are also architectural gains to using AOP for security. For example, one of the biggest challenges with input validation today is that there are so many interfaces to a complex application. Many large enterprise applications have more than just a single Web HTML interface. A single Web application could have entry points through:

  • Web services
  • Rich clients (e.g. applications, applets)
  • Enterprise-Java Beans
  • CORBA connections
  • Other middle-tier connections

Building input validation controls in just one interface (e.g. implementing servlet filters for Web clients) does not prevent attacks from entering in another interface (e.g. Web services). At the same time, attacks such as cross-site scripting only affect certain interfaces (e.g. Web browsers) and not others (e.g. rich applications). With AOP, you define the defenses such as regular expressions in aspects and then define where they should be implemented through pointcuts. This means that some defenses could be pointed at interface code, whereas others could be pointed at business logic (as we did in the NewLead example).

Implementation Details and Performance Impact

So how exactly does AOP work? Well, that depends on the platform you are using. I've discussed AspectJ here for a few very specific reasons:

  • It is very easy to integrate AspectJ into existing Java applications. AspectJ simply adds Aspects into Java binaries by using a technique called "weaving", which essentially changes the compiled code to add advice at the specified pointcuts. At runtime for Web applications you just need to add the aspectjrt.jar library to your project's WEB-INF\lib
  • If you are using the Eclipse Integrated Development Environment (IDE), converting an existing Java application to AspectJ is trivial with AspectJ Development Tools [5]
  • Since AspectJ works at compile time (or at least prior to load/execution time), it is very efficient and does not generally incur significant performance impact

As I mentioned at the start of this article, the Spring Framework also provides AOP support. There are a few major by-design differences with Spring AOP and AspectJ, most notably that Spring works on top of Java and does not require a different compiler. Since Spring's AOP occurs during runtime, there can be a substantial performance penalty. Moreover, Spring AOP support is designed for Spring-controlled beans, which means integrating it into an existing non-Spring-based application can be difficult. That being said, Spring's AOP is still very valuable when AspectJ is not feasible or in applications already using Spring. Spring developers intentionally provided support to integrate Spring's Inversion of Control capabilities with AspectJ's powerful AOP [6].

Remote control for virtualized desktops

Next page: What's next?

More from The Register

next story
PEAK APPLE: iOS 8 is least popular Cupertino mobile OS in all of HUMAN HISTORY
'Nerd release' finally staggers past 50 per cent adoption
Microsoft to bake Skype into IE, without plugins
Redmond thinks the Object Real-Time Communications API for WebRTC is ready to roll
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
Mozilla: Spidermonkey ATE Apple's JavaScriptCore, THRASHED Google V8
Moz man claims the win on rivals' own benchmarks
FTDI yanks chip-bricking driver from Windows Update, vows to fight on
Next driver to battle fake chips with 'non-invasive' methods
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Ubuntu 14.10 tries pulling a Steve Ballmer on cloudy offerings
Oi, Windows, centOS and openSUSE – behave, we're all friends here
Was ist das? Eine neue Suse Linux Enterprise? Ausgezeichnet!
Version 12 first major-number Suse release since 2009
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.