Kotlin Application Security: Top 10 Vulnerabilities for Beginners

Kotlin Application Security: Top 10 Vulnerabilities for Beginners

Kotlin is a modern programming language actively used for creating Android applications, server-side solutions, and multiplatform projects. However, even with its strict typing and safety by default, novice developers often make mistakes that can lead to serious vulnerabilities. In this article, we will cover the top 10 most common security issues in Kotlin applications, show examples of dangerous code, and provide recommendations for fixing them.

1. SQL Injection

One of the oldest and most dangerous vulnerabilities. If you directly concatenate user input into an SQL query, an attacker can execute arbitrary commands.

// DANGEROUS: string concatenationval query = "SELECT * FROM users WHERE name = '$userInput'"statement.executeQuery(query)

// SAFE: using parameterized queriesval query = "SELECT * FROM users WHERE name = ?"val preparedStatement = connection.prepareStatement(query)preparedStatement.setString(1, userInput)preparedStatement.executeQuery()

2. Unsafe Password Storage

Never store passwords in plain text. Use bcrypt, Argon2, or PBKDF2. In Kotlin, you can use the spring-security-crypto library or kotlinx-serialization with hashing.

// DANGEROUS: storing in plain textdata class User(val password: String)

// SAFE: hashing with saltimport org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder

val encoder = BCryptPasswordEncoder()val hashedPassword = encoder.encode(plainPassword)

3. Lack of Input Validation

Any data from the user must be validated. Ignoring this rule leads to XSS, injections, and DoS attacks.

// DANGEROUS: direct output without escapingfun renderHtml(userInput: String): String {    return "<div>$userInput</div>"}

// SAFE: HTML escapingimport org.owasp.encoder.Encode

fun renderSafeHtml(userInput: String): String {    return "<div>${Encode.forHtml(userInput)}</div>"}

4. Data Serialization Vulnerabilities

Kotlin uses kotlinx.serialization or Gson/Moshi. Incorrect configuration can lead to exposure of sensitive data or remote code execution.

// DANGEROUS: serializing all fields@Serializabledata class User(    val name: String,    val passwordHash: String // hash leak!)

// SAFE: excluding sensitive fields@Serializabledata class SafeUser(    val name: String,    @Transient val passwordHash: String = "")

5. Unsafe WebView Usage (Android)

When developing Android applications in Kotlin, WebView is often used. If JavaScript is not disabled or filtering is not configured, an XSS attack is possible.

// DANGEROUS: JavaScript enabled without filteringwebView.settings.javaScriptEnabled = truewebView.loadUrl("file:///android_asset/index.html")

// SAFE: disable JavaScript for static contentwebView.settings.javaScriptEnabled = false// Or use Content Security PolicywebView.loadDataWithBaseURL(null, content, "text/html", "UTF-8", null)

6. Improper Session Management

Storing authentication tokens in SharedPreferences without encryption is a common mistake. Use EncryptedSharedPreferences or Android Keystore.

// DANGEROUS: storing token in plain textval prefs = context.getSharedPreferences("auth", Context.MODE_PRIVATE)prefs.edit().putString("token", token).apply()

// SAFE: encrypted storageval encryptedPrefs = EncryptedSharedPreferences.create(    "secure_prefs",    MasterKey.DEFAULT_MASTER_KEY_ALIAS,    contex