[software development specification II] prohibited item development specification

​​ One 、 Apply prohibitions 4​​

​​ Two 、 Database prohibitions 7​​

​​ 3、 ... and 、 Production environment prohibitions 10​​

One 、 Apply prohibitions

1. 【 mandatory 】 It is forbidden to release untested code to the production environment .

explain ： Testing is very important , Because software errors can be expensive or even dangerous , One bug The longer it gets, the less it gets discovered , It may bring more hidden dangers . Besides , If the test team missed the accurate and detailed capture or identification of risks and software problems , It could lead to some kind of disaster , Then you need to pay a high price to detect bug, So software vulnerabilities or Bug It could lead to losses of money and people .

2. 【 mandatory 】 No need 、 The function without design documents goes online .

explain ： Design documents are product managers 、 project manager 、 R & D personnel 、 Salesman 、 A bridge for communication between operation promotion personnel , A good functional requirements design document is the key to the success of software products . With the design documentation , It can guarantee that our general direction is not wrong , Improper design can be corrected immediately , The vague part will have an idea immediately , Greatly reduces the development time and reduces the difficulty of coding , Also improve the working efficiency of the team and the company .

3. 【 mandatory 】 Do not use Maven management Jar. 

4. 【 mandatory 】 It is forbidden to execute batch processing that affects the performance of the database during the business working hours of the application system .

explain ： Affect the normal use of users , Poor user experience , Causing the system to crash , Unexpected consequences occur .

5. 【 mandatory 】 It is forbidden to cross the execution time of two batches of the same batch .

explain ： Because it is easy to make mistakes due to repeated system data processing .

Solution ： Add task lock processing , The execution of batch processing adopts the mechanism of polling .

6. 【 mandatory 】 Batch processing is prohibited 、 Interface or Ftp The configuration information is written in the program , Hard code hostname is forbidden in code 、IP、 user 、 password .

explain ： Maintainability is not strong .

Avoid scheme ： The configuration information is written in the external configuration file .

7. 【 mandatory 】 It is forbidden to provide the function of background administrator to delete or modify logs .

8. 【 mandatory 】 Prohibit the application from changing the application log record .

9. 【 mandatory 】 It is forbidden to store the user account password in the application system in clear text

explain ： There are many threats to the data stored in the database , There's an application level 、 Database level 、 Operating system level 、 Computer room level 、 At the employee level , Want to do 100% not to be hacked , Very difficult . If the password is encrypted and then stored , So even if it's towed to the library , Hackers also find it difficult to get users' plaintext passwords .

10. 【 mandatory 】 Do not use System.out、System.err Output information to the console .

explain ：

Ø  The information output in this way cannot be preserved ： Because the console is fixed in the production environment , Therefore, the information of the console is not retained ;

Ø  This method will affect the operation performance of the system ： Unable to output , It will affect the production and operation efficiency .

Solution ：

Ø  Adopt a general logging framework , about System.out Input using ：Logger.debug Record .

Ø  about System.err use Logger.error For recording .

11.  It is forbidden to use only Exception.printStackTrace() Print the exception stack directly to the console .

explain ：printStackTrace() The stack log printed out is interlaced with the normal output or business code execution log , In the case of large concurrent log output , It is very difficult to check the exception log . And output directly to the console , Memory will be filled when stack information is too long .

Example ：

try {

...

 } catch (Exception e1) {

 log.error("data Message encryption failed ！", e1.getMessage());

}finally{

......

}

Counter example ：

try{

...

}catch (Exception e1) {

 e1.printStackTrace();

 log.error("data Message encryption failed ！");

}finally{

......

}

12. 【 mandatory 】 No use double or float Define variables of amount type and perform operations .

explain ： because double/float Decimals may appear when representing amounts , For the amount in the financial project , Error is intolerable .

Example ： Use BigDecimal Control accuracy .

13. 【 mandatory 】 Prohibit applications from using non precompiled （PreparedStatement） Schema for database operations .

explain ：

Ø  Use it directly Statement The way , Will result in every SQL Implementation needs to be carried out SQL compile ;

Ø  Spell it SQL May cause SQL Injected security vulnerabilities .

14. 【 mandatory 】 It is forbidden to develop or use thread based applications provided by non development frameworks in applications .

explain ： Threads are difficult to control , Bad use may lead to server downtime .

Solution ： Use thread pool to manage threads .

15. 【 mandatory 】 It is forbidden to load unlimited data sets from the database , Yes, it may be greater than 10 The table of 10000 data must be queried in paging mode .

explain ： For no size limit, it may appear when the query conditions are inappropriate , Query tens of thousands of data at one time , May cause memory overflow errors . When performing any database operation, you must limit the number .

16. 【 mandatory 】 It is forbidden to use large strings and regular expression operations in the application system .

explain ： Too large regular expressions will affect the efficiency .

17. 【 mandatory 】 File upload needs to limit the file size and type , After uploading, you cannot use the original file name to save .

18. 【 mandatory 】 No use Object.finalize() .

explain ：JVM Will pass when necessary GC Garbage collection thread to call finalize function , However, due to the uncertain call time and other reasons beyond our control , Cannot be used reliably finalize（） Complete the closing task , For example, as closed I / O flow , May cause waste of resources 、 leak , Which affects performance .

19. 【 mandatory 】 It is forbidden to completely display customers' privacy data in Internet applications （ Such as ： ID number , Credit card number ）.

20. 【 mandatory 】 Prohibit Internet applications from using email and SMS sending functions without graphic verification code .

21. 【 mandatory 】 Input validation prohibits authentication only on the client side , It must be verified on the server side .

explain ： The authentication of the client often depends on the browser , If the malicious attack of a malicious user is not submitted through the browser , Client authentication is useless .

22. 【 mandatory 】 It is forbidden to use insecure algorithms for data encryption , If only MD5 Algorithm .

explain ：MD5 Hashed data , It can be cracked in a few minutes .

Avoid scheme ： You should use SHA2 Hash algorithm with the intensity of and above .

23. 【 mandatory 】 It is forbidden to use reversible algorithms to encrypt user passwords .

24. 【 mandatory 】 It is forbidden to store the customer's contact information in clear text on the client 、 Sensitive data such as ID number （ Such as ： Permanence cookie,SQLite）.

explain ： It is forbidden to save the password to the local client , Even the encrypted password is not recommended to be saved locally , An attacker can use the password in ciphertext format to log in or modify the password of other accounts .

25. 【 mandatory 】 It is forbidden to transmit sensitive data in plaintext for extranet applications .

explain ： When we submit sensitive data to the server on the website, we do not encrypt it , Cause the attacker to attack through man in the middle （ hijacked 、 Sniffing, etc. ） You can get these unencrypted sensitive data . After the attacker obtains these data , You can use this information to enter the application system as a legal user —— It may even enter the background of the application system , Once you enter the application system, you can get more sensitive data , And more opportunities to find more vulnerabilities .

26. 【 mandatory 】 It is forbidden to call the application interface exposed on the public network without identity authentication and permission control .

explain ： from HTTP The data communicated by the protocol is mostly unencrypted plaintext , Including request parameters 、 Return value 、 cookie、 head Data, etc. , therefore , The outside world monitors communication , It's easy to follow the format of both the request and the response , Forge requests and responses , Modify and steal all kinds of information . So we also need to authenticate every request , To determine whether the user who initiated the request , And whether the requested information has been tampered .

Two 、 Database prohibitions

27. 【 mandatory 】 It is forbidden to have design documents without database or documents that are inconsistent with the actual database .

explain ：

28. 【 mandatory 】 It is forbidden to have design documents without database or documents that are inconsistent with the actual database .

explain ： Database is the foundation of the whole software application , It is the starting point of software design , It plays a decisive role in qualitative change , Therefore, we must attach great importance to database design , Cultivate the habit of designing a good database , It is the basic quality that an excellent software designer must have . There is no database design document or the document is inconsistent with the actual database , It will add a lot of workload to later maintenance .

29. 【 mandatory 】 Prohibit database changes that are incompatible with the previous version of the program .

explain ： Prevent database structure changes from directly deleting the originally used columns , Cause the program to fail to rollback .

30. 【 mandatory 】 It is forbidden to have the fields of creation time and last modification time missing in the design of key business data operation table .

31. 【 mandatory 】 Newly developed application system or new module (oracle Application on database platform ) No use Oracle TEXT Do text retrieval inside the database （ Efficiency is very low ）.

32. 【 mandatory 】 prohibit JDBC The variable type passed in during query is inconsistent with the column definition data type of the table .

explain ： There will be some unexpected bug, Finding willingness will take a lot of time .

33. 【 mandatory 】 Prohibit remote system calls in database transactions .

explain ： Remote calls may be slow , It will prolong the time for transactions to lock the database , Increase the probability of deadlock .

Solution ： Remote calls and database updates are handled separately , First call remotely and then update the database uniformly .

34. 【 mandatory 】 The following field types are prohibited , Include ：

1)  Obsolete old type ：RAW,LONG,LONG RAW;

  explain ： new edition Oracle These types are no longer recommended , Recommended CLOB,BLOB, It's all internal LOB(Large Object) type , The longest 4G.

2)  Nonstandard ：

VARCHAR2(n CHAR)、CHAR(n CHAR)

VARCHAR2(n CHAR) Change it to VARCHAR2(n);

CHAR(n CHAR) Change it to CHAR(n);

3)  National character set related ：

NCHAR、NVARCHAR2、NCLOB.

NCHAR Change it to CHAR;

NVARCHAR2 Change it to VARCHAR2;

NCLOB Change it to CLOB.

35. 【 mandatory 】 Prohibit the application from using DBA Privileged user access database ( Mainly for data security ）.

36. 【 mandatory 】 Users who prohibit applications from connecting to the database （ Application users ） Have select any dictionary jurisdiction （ You can specifically grant permission to query specific data dictionary tables ）( Mainly for data security ）.

37. 【 mandatory 】 No videos 、 Audio and other multimedia files are stored Oracle Inside the database , No use Oracle Of Mutlimedia function , Multimedia files should be stored in the file system outsourced by the database .

38. 【 mandatory 】 Newly developed application system or new module , Except for temporary table , Prohibit the use of tables without logs and operations without logs （ In the database parameter configuration standard, no log table and no log operation have been prohibited from the bottom , Such as ：oracle The database is set force logging Pattern ）.

39. 【 mandatory 】 It is forbidden to directly use delete table statements in the application system .

explain ： Directly delete data and table structure .

Counter example ：drop table xx;

40. 【 mandatory 】 The newly developed application system or new module is forbidden to use Chinese and special symbols to name the table 、 Indexes 、 View and so on .

explain ：Oracle Chinese is forbidden in the standard naming rules 、 Space 、 Special characters, etc , Avoid program errors caused by ignoring double quotation marks in subsequent use , If not necessary , No use .

41. 【 mandatory 】 It is forbidden to use materialized views for newly developed application systems or new modules (mview) and trigger .

explain ： High resource consumption ; Each trigger is a hidden stored procedure , As batch modification , Multiple triggers trigger Trigger time , Inefficient and easy to deadlock .

42. 【 Suggest 】 It is suggested that large tables should not be associated with other tables in the application system , And more than three tables .

explain ： Reconstructing queries by decomposing associative queries makes caching more efficient . Many applications can easily cache the result object corresponding to a single table query . In addition to MySQL In terms of query caching , If a table in the association changes , Then you can't use the query cache , And after the split , If a table rarely changes , Then queries based on this table can reuse query cache results . After decomposing the query , Performing a single query reduces lock contention . Making connections in the application layer , It's easier to split the database , It's easier to be high-performance and scalable . Query itself may also be more efficient , It can reduce the query of redundant records .

3、 ... and 、 Production environment prohibitions

43. 【 mandatory 】 It is forbidden to pass in the production environment root System account number 、DBA Permission database account for application deployment , It must be managed by applying hierarchical permissions .

explain ： Security reasons .

Avoid scheme ： Hierarchical permission management .

44. 【 mandatory 】 It is forbidden to install the files required by the application on the /home、/usr、/var Wait for the directory .

explain ： Avoid causing system problems .

Avoid scheme ： It should be installed on app Next .

45. 【 mandatory 】 Untested hardware devices are prohibited .

explain ： Installation and use safety issues .

Avoid scheme ： Use the server that the company purchases centrally to realize the function .

46. 【 mandatory 】 It is forbidden to use single power supply equipment .

explain ： Use safety issues .

Avoid scheme ： Use dual power supply .