Java Security Traps Getting Worse
Updated: At JavaOne last year, Fortify's Brian Chess discussed how to avoid Java security holes. A year later, with even Sun's manuals containing code with cross-site scripting vulnerabilities, we're actually worse off than ever.
Context & Ripple Effects
A year after Fortify's Brian Chess used his JavaOne platform to walk developers through avoiding Java security holes, the picture has inverted: Sun's own manuals now ship sample code carrying cross-site scripting vulnerabilities, per the confirmed reporting behind this piece. The lesson being taught and the practice being modeled have diverged.
The timing compounds an existing vulnerability of a different kind. As early as December 2005, Java was already flagged as losing ground among Web developers to a raft of newer competing languages — so the language's steward is publishing insecure examples precisely while its mindshare is under pressure.
First-order effects
- Developers who treat Sun's manual code as canonical will copy the cross-site scripting flaws directly into production applications, spreading the defect faster than Chess-style guidance can correct it.
- Fortify's advisory business gets a concrete proof point: if even vendor-authored documentation fails review, enterprise buyers have visible evidence that source-code analysis — Fortify's product category — is checking something their own teams are missing.
Second-order effects
- Sun faces a credibility bill beyond the bugs themselves: its documentation doubles as de facto training material for the Java ecosystem, so unvetted examples force Sun to either audit its manuals or cede the security-narrative to third-party analysts like Fortify.
- With Java already documented as losing developers to newer languages since late 2005, persistent security embarrassments give migrating teams one more reason to defect, pressuring Sun's platform economics rather than just its reputation.
Third-order effects
- If vendor-published example code keeps seeding real-world flaws, the industry's structural answer shifts from patching individual holes toward institutionalizing automated code review in the development lifecycle — the space Fortify occupies — because manual vigilance has demonstrably failed even inside Sun.
- The deeper pattern is that a platform's security posture becomes inseparable from its documentation quality: whoever controls the examples controls the baseline of what millions of applications inherit, making documentation auditing a governance issue for any dominant language owner.
The trend: Official example code is emerging as an attack-surface multiplier for mainstream platforms, pushing security responsibility from developers' diligence toward automated source-code analysis vendors.