Polyglot apps lead to Polyglot security holes. Time to fight back!
summary
Shows that mapping client WebComponents to server-side Java via Vaadin Flow and a custom UI5-to-Java repo (Apache license) adds hidden npm/javascript surfaces and transitive vulnerabilities. Demonstrates a Java-first test stack using JUnit5 + Selenium/TestBench to run browser-backed component tests, and a CI/repo strategy with Artifactory + Xray and JFrog Pipelines to scan Docker, npm and Maven artifacts, enforce policies, and produce immutable builds for fast remediation.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:50BirdEye View - Cloud Native
- 22:14SecurityPayload Generator Injection
- 27:02Low-hanging Fruits - Dependencies
- 30:30Security from scratch
- 33:10The power of integration
related talks
37mUsing WebComponents with Java on the Server Side to harden the stack
48mThe Hidden Security Hazards in Your Java Stack
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
49mWeb Components for Java Developers
01h 06mLive hacking: Breaking into your Java web app
47mThe Hidden Security Hazards in Your Java Stack
48mCommon vulnerabilities you wish your Java app didn't have!
47mModern web with Web Components and Java