November 2019
Beginner to intermediate
406 pages
9h 21m
Chinese
Content preview from Java持续交付
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
306
｜
第
12
章
系统质量属性测试：验证非功能性需求
代码级别的安全验证
对于检查
Java
代码安全问题的工具，我们首先推荐
FindBugs
静态分析器（之前已经提
到过）的
Find Security Bugs
插件（
http://find-sec-bugs.github.io/
）。它可以检测
125
种漏
洞类型，其中超过
787
个唯一的
API
签名。该工具与
Maven
和
Gradle
等构建工具可以
很好地集成，能够根据检查结果生成
XML
和
HTML
报告。
商业代码扫描工具的价值
根据安全要求，你可能需要购买商业的安全代码扫描工具，例如
Black Duck
（
https://
www.blackducksoftware.com/
）或者
Sonatype
的
Nexus Software Supply Chain
Management
（
https://www.sonatype.com/
）。这些公司专注于发现和降低安全风险，
因为这个领域的发展和变化速度非常快。每天都会发生新的攻击，每天也都会出
现新的漏洞。如果你觉得购买商业安全扫描工具比较昂贵，请考虑是否能够承担
出现安全漏洞的成本。
Find Security Bugs
插件的文档内容非常全面。在
Bug Patterns
页面（
http://find-sec-bugs.
github.io/bugs.htm
），你可以找到一份插件检查的所有安全问题清单。以下列举了其中一
些检查项 ：
y
可预测的伪随机数生成器
y
不受信任的
servlet
参数或者查询字符串
y
cookie
中可能的敏感数据 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.