MVC (Model-View-Controller) represents a software design pattern extensively utilized in Java enterprise development.

Model Component

The Model handles data processing logic, including data mapping and CRUD operations. This layer typically contains beans, data access objects (DAOs), and related data structures.

View Component

Views manage data presentation and user interface rendering. HTML, JSP, and other templating technologies commonly implement this layer.

Controller Component

Controllers serve as intermediaries between Models and Views, managing data flow and user interactions. They process input from Views, communicate with Models, and return data for presentation.

Project Structure Analysis

Understanding project architecture is fundamental to code review. The src/main directory typically contains:

Java Source Directory

• annotation: Custom project annotations
• controller: Request handlers with parameter validation and basic business logic
• dao: Data access layer components for database operations
• entity: Domain model classes
• interceptor: Request interception logic
• service: Business logic interfaces and implementations
• utils: Utility classes
• dto: Data transfer objects for request/response handling
• vo: View objects for data encapsulation and security
• constant: Application constants
• filter: Request filtering components

Resources Directory

• mapper: MyBatis XML configuration files
• static: Static assets (JavaScript, CSS, images)
• templates: View templates
• application.properties/application.yml: Spring Boot configuration

Request Flow Processing

HTTP requests follow this sequence: Filter → Interceptor → Controller → Service Interface → Service Implementation → DAO layer.

Common Annotations and Methods

Spring Annotations

@Controller marks classes as request handlers. Combined with @ResponseBody, it enables direct JSON responses for REST APIs.

@RestController combines @Controller and @ResponseBody functionality.

@RequestMapping maps URLs to handler methods:

@RestController
@RequestMapping("/api")
public class UserEndpoint {
    
    @GetMapping("/profile/{userId}/{type}")
    public String getUserProfile(@PathVariable("userId") String id, 
                                 @PathVariable("type") String profileType) {
        return "User " + id + " - " + profileType;
    }
}

@RequestParam binds request parameters to method arguments, commonly used for form submissions.

Untrusted Data Entry Points

Method	Purpose
getParameter	Retrieves request parameters
getParameterNames	Lists parameter names
getParameterValues	Returns parameter values
getParameterMap	Provides parameter mapping
getQueryString	Extracts URL query values
getHeader	Accesses HTTP headers
getHeaderNames	Lists header names
getRequestURI	Obtains request URI
getCookies	Retrieves cookies
getRequestedSessionId	Gets session identifier
getInputStream	Reads input stream
getReader	Accesses request content
getMethod	Identifies HTTP method
getProtocol	Determines request protocol
getServerName	Returns server name
getRemoteUser	Retrieves cached user
getUserPrincipal	Obtains user principal

File Operations Methods

Method	Description
FileInputStream	File input operations
FileOutputStream	File output operations
FileReader	File reading
FileWriter	File writing

Security Review Methodology

Third-Party Component Analysis

Examine pom.xml for vulnerable dependencies:

• Frameworks: Struts2, Shiro, Spring
• Middleware: JBoss, WebLogic, Jenkins
• Libraries: Fastjson, Jackson
• Editors: UEditor, KindEditor, FCKeditor

Use automated tools like PomEye:

python3 main.py

Configuration Review

Filter Analysis

Search for doFilter implementations. Filters work across frameworks while interceptors are Spring-specific.

Example XSS filter configuration:

<filter>
    <filter-name>securityFilter</filter-name>
    <filter-class>com.example.filter.SecurityFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>securityFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Filter implementation:

public class SecurityFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                        FilterChain chain) throws IOException, ServletException {
        SecurityRequestWrapper wrappedRequest = new SecurityRequestWrapper((HttpServletRequest) request);
        chain.doFilter(wrappedRequest, response);
    }
}

Request wrapper for XSS prevention:

public class SecurityRequestWrapper extends HttpServletRequestWrapper {
    public SecurityRequestWrapper(HttpServletRequest request) {
        super(request);
    }
    
    @Override
    public String[] getParameterValues(String paramName) {
        if("richtext".equals(paramName)) {
            return super.getParameterValues(paramName);
        }
        String[] originalValues = super.getParameterValues(paramName);
        String[] sanitizedValues = new String[originalValues.length];
        for (int i = 0; i < originalValues.length; i++) {
            sanitizedValues[i] = HtmlUtils.htmlEscape(originalValues[i]);
        }
        return sanitizedValues;
    }
}

Configuration Files

Review application.properties and application.yml for:

• Spring Boot Actuator unauthorized access
• Database connection details
• Druid authentication configurations

Interceptor Configuration

Search for WebMvcConfigurer implementations and review interceptor directories.

Code Review Approaches

Forward Analysis

Search pattern: @(.*?)Mapping\( Trace external parameters from controllers through execution flow to identify security risks.

Reverse Analysis

Identify dangerous functions and trace parameter origins to validate input sanitization.

Feature-Based Review

Analyze specific application functionalities for security implications.

Tool-Assisted Review

Combine automated scanning with manual code inspection.

Patch Comparison

Compare code versions to identify security fixes and potential vulnerabilities.

Common Vulnerability Patterns

Authentication and Authorization Issues

Third-Party Component Unauthorized Access

Actuator Endpoints Dependency: spring-boot-starter-actuator Configuration: management.endpoints

Vulnerable endpoints:

• /actuator/heapdump - Database credential extraction
• Session management vulnerabilities

Remediation:

endpoints.env.enabled=false

Swagger Documentation Dependency: springfox-swagger-ui

Remediation options:

• Disable documentation: .enable(false)
• Implement authentication mechanisms
• Restrict access by IP range
• Remove from production environments

Druid Monitoring Configuration: druid settings

Authentication Bypass

Filter Misconfiguration Session-based authentication flaws where path matching allows unauthorized access.

Interceptor Vulnerabilities Using request.getRequestURI() for path matching can be bypassed with special characters:

• /;/admin/endpoint
• ///admin/endpoint

Use getRequestURL() instead for proper path resolution.

Spring Security Configuration Authorization rules using antMatchers():

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
        .antMatchers("/admin/**").hasRole("admin")
        .antMatchers("/user/**").hasRole("user")
        .antMatchers("/public").permitAll()
        .anyRequest().authenticated()
        .and()
        .formLogin();
}

Proper configuration order is critical - specific rules should precede general ones.