Wouter Coekaerts

225 posts

Wouter Coekaerts

@WouterCoekaerts

Programming puzzles and security enthousiast. ex-@Square . @[email protected]

Belgium Katılım Ekim 2010

196 Takip Edilen514 Takipçiler

Wouter Coekaerts@WouterCoekaerts·12 Eyl

I'm excited to announce FlowTracker, a Java agent that tracks data flowing through Java programs. It helps you understand where any program got its output from, what it means, and why it wrote it. Watch the video, explore the live demo and read more at github.com/coekie/flowtra…

English

870

Wouter Coekaerts retweetledi

Simone Margaritelli@evilsocket·21 Ağu

The hacker spirit breaks any spell.

English

143

14K

Wouter Coekaerts@WouterCoekaerts·13 Tem

@tagir_valeev That makes sense. I guess the further away (e.g. same expression or not) from the code that was asked to be refactored the more surprising / less desirable it is. I don't know where I'd draw the line.

English

Tagir Valeev@tagir_valeev·13 Tem

@WouterCoekaerts Well, we do like this sometimes. E.g., try to extract variable here. You'll get magically your ternary rewritten to if-else. Because otherwise, the result of extraction will likely be erroneous.

English

109

Tagir Valeev@tagir_valeev·13 Tem

Assume that you want to extract method from the 'if' branch, leaving else-branch as is: public int test(boolean b) { if (b) { System.out.println("You're in the wrong branch"); throw new IllegalArgumentException(); } else { return 42; } }

English

11.7K

Wouter Coekaerts@WouterCoekaerts·13 Tem

@tagir_valeev Tough choice. I like option 4 the least, because that is changing code outside what I told it to refactor. Imo the ide shouldn't do that without asking. It might be smart, but it's... disobedient.

English

118

Tagir Valeev@tagir_valeev·13 Tem

So, what would you expect from your favorite IDE?

English

4.2K

Wouter Coekaerts@WouterCoekaerts·12 Tem

I just added solutions to the non-empty empty String challenge. A simple one, but also two original solutions, including one that does not even use any concurrency!

English

2.2K

Wouter Coekaerts@WouterCoekaerts·11 Tem

Abusing a bug in java.lang.String to make "hello world" not start with "hello". Plus a challenge: make an empty String that is not equal to "". wouter.coekaerts.be/2023/breaking-…

English

176

24.8K

Wouter Coekaerts@WouterCoekaerts·12 Tem

@Raumzeitfalle there it is: bugs.java.com/bugdatabase/vi… but bugs.openjdk.org/browse/JDK-831… asks me to log in to be able to see it

English

Wouter Coekaerts@WouterCoekaerts·11 Tem

@Raumzeitfalle Ah, it went through now. "We will review your report and have assigned it an internal review ID : 9075516"

English

276

Wouter Coekaerts@WouterCoekaerts·5 May

@BrianVerm Reflective XSS, stored XSS, and a format string vulnerability. twitter.com/WouterCoekaert…

Wouter Coekaerts@WouterCoekaerts

You can say that format string vulnerabilities are not a thing in Java, but String.format("%2147483647%") is not your friend.

English

@·3 May

What are the 2 security problems in this Java code. If you need a hint check this blogpost: buff.ly/3Hi6WEh

English

14.2K

Wouter Coekaerts@WouterCoekaerts·31 Mar

@doppel_ichi @jordanschneider WinWAR!

Deutsch

498

@·30 Mar

TIL Ukraine is running its war on discord

English

112

1.4K

12.5K

2.2M

Wouter Coekaerts@WouterCoekaerts·18 May

@jeroen404 404.be laten forwarden naar vooruit.org, om voor maximale verwarring te zorgen. Of carglass.be.

Nederlands

Jeroen Kapoen@jeroen404·18 May

404 betreurt nieuwe naam Vooruit 😝😜 viernulvier.gent/nl/nieuws/341/…

Nederlands

Wouter Coekaerts@WouterCoekaerts·20 Nis

@tagir_valeev new Recursion() { int i = 0; @Override public void test() { if (i++ == 0) super.test(); } }.test();

English

Tagir Valeev@tagir_valeev·20 Nis

A #Java puzzle: is it possible to execute the `test()` method and actually have the "Recursion!!!" string printed without modifying the Recursion class (imagine it's a part of compiled library)?

English

Wouter Coekaerts@WouterCoekaerts·17 Mar

Your Downloads folder is like that box of old cables you don't want to throw away. Hundreds or even thousands of cables. Some of them pretty questionable.

SwiftOnSecurity@SwiftOnSecurity

*Jesus sees your Downloads folder that has everything since 2012, which you move between computers* "Bro what the fuck is this"

English

Wouter Coekaerts@WouterCoekaerts·26 Şub

@obsurdle @mipsytipsy What happened to the 'H'?

English

Wouter Coekaerts@WouterCoekaerts·1 Oca

@traviscj Always defragment your vegetables for the best performance.

English

@·1 Oca

It’s been UN MEDLEYED!

English

Wouter Coekaerts@WouterCoekaerts·20 Ara

Now that another string formatting DoS vulnerability in java (CVE-2021-45105) is in the news, a reminder: Passing user input into the format for String.format also makes you vulnerable to a DoS.

Wouter Coekaerts@WouterCoekaerts

You can say that format string vulnerabilities are not a thing in Java, but String.format("%2147483647%") is not your friend.

English

Wouter Coekaerts@WouterCoekaerts·29 Haz

@nickjshearer copilot.github.com now shows me sentiment.ts as the first example, which is not better. It adds a "urlencoded" header, but it's not actually url encoded. What if `text` contains a `&`? You might even call that a security vulnerability.

English

Keşfet

@tagir_valeev @Raumzeitfalle @BrianVerm @doppel_ichi @jordanschneider @jeroen404 @Override @elonmusk