War Story: We Used Deprecated Java 24 APIs and Got Hacked in 2026

import sun.misc.BASE64Encoder; // Deprecated since Java 9, forRemoval=true in Java 24
import java.util.Date; // Multiple methods deprecated since Java 1.1, forRemoval=true in Java 24
import java.text.SimpleDateFormat;
import java.util.HashMap;
import java.util.Map;
import java.util.logging.Logger;
import java.io.UnsupportedEncodingException;

/**
 * Vulnerable authentication service using deprecated Java 24 APIs.
 * This class was the entry point for the 2026 breach due to unpatched
 * Base64 encoding and date parsing logic with known CVEs.
 */
public class VulnerableAuthService {
    private static final Logger LOGGER = Logger.getLogger(VulnerableAuthService.class.getName());
    private static final BASE64Encoder ENCODER = new BASE64Encoder(); // Deprecated: use java.util.Base64 instead
    private static final Map SESSION_CACHE = new HashMap<>();

    /**
     * Generates a session token using deprecated Base64 encoding and Date APIs.
     * @param userId Unique user identifier
     * @return Session token string, or null if encoding fails
     * @deprecated Use {@link SecureAuthService#generateSessionToken(String)} instead
     */
    public String generateSessionToken(String userId) {
        if (userId == null || userId.trim().isEmpty()) {
            LOGGER.warning("Attempted to generate session token for null/empty userId");
            return null;
        }

        try {
            // Deprecated: Date getters are not thread-safe and have Y2K38 issues
            Date now = new Date();
            int year = now.getYear() + 1900; // Deprecated getYear() returns years since 1900
            int month = now.getMonth() + 1; // Deprecated getMonth() returns 0-11
            int day = now.getDate(); // Deprecated getDate()
            int hour = now.getHours(); // Deprecated getHours()
            int minute = now.getMinutes(); // Deprecated getMinutes()

            // Insecure token payload: no cryptographic signing, uses deprecated encoding
            String tokenPayload = String.format("%s|%d-%d-%d|%d:%d", userId, year, month, day, hour, minute);

            // Deprecated Base64 encoder: no padding control, vulnerable to CVE-2023-25193
            byte[] payloadBytes = tokenPayload.getBytes("UTF-8");
            String encodedToken = ENCODER.encode(payloadBytes); // Deprecated method

            // Store in insecure cache (no TTL, vulnerable to overflow)
            SESSION_CACHE.put(encodedToken, userId);
            LOGGER.info(String.format("Generated session token for user %s: %s", userId, encodedToken));
            return encodedToken;
        } catch (UnsupportedEncodingException e) {
            // Deprecated: catch block does not wrap in RuntimeException, swallows error
            LOGGER.severe(String.format("UTF-8 encoding not supported: %s", e.getMessage()));
            return null;
        } catch (Exception e) {
            LOGGER.severe(String.format("Unexpected error generating token: %s", e.getMessage()));
            return null;
        }
    }

    /**
     * Validates a session token using deprecated parsing logic.
     * @param token Session token to validate
     * @return Associated userId if valid, null otherwise
     */
    public String validateSessionToken(String token) {
        if (token == null || token.trim().isEmpty()) {
            LOGGER.warning("Attempted to validate null/empty session token");
            return null;
        }

        try {
            // Deprecated: no URL-safe Base64 decoding, vulnerable to injection
            byte[] decodedBytes = ENCODER.decodeBuffer(token); // Deprecated decodeBuffer method
            String payload = new String(decodedBytes, "UTF-8");
            String[] parts = payload.split("\\|");

            if (parts.length != 3) {
                LOGGER.warning(String.format("Invalid token payload format: %s", payload));
                return null;
            }

            // Deprecated date parsing: no timezone handling, vulnerable to time spoofing
            String datePart = parts[1];
            String[] dateParts = datePart.split("-");
            if (dateParts.length != 3) {
                LOGGER.warning(String.format("Invalid date part in token: %s", datePart));
                return null;
            }

            // Deprecated: manual date validation with no leap year logic
            int year = Integer.parseInt(dateParts[0]);
            int month = Integer.parseInt(dateParts[1]);
            int day = Integer.parseInt(dateParts[2]);
            if (month < 1 || month > 12 || day < 1 || day > 31) {
                LOGGER.warning(String.format("Invalid date values: %d-%d-%d", year, month, day));
                return null;
            }

            return SESSION_CACHE.get(token);
        } catch (UnsupportedEncodingException e) {
            LOGGER.severe(String.format("UTF-8 decoding not supported: %s", e.getMessage()));
            return null;
        } catch (Exception e) {
            LOGGER.severe(String.format("Unexpected error validating token: %s", e.getMessage()));
            return null;
        }
    }

    public static void main(String[] args) {
        VulnerableAuthService service = new VulnerableAuthService();
        String token = service.generateSessionToken("user-12345");
        System.out.println("Generated token: " + token);
        String userId = service.validateSessionToken(token);
        System.out.println("Validated userId: " + userId);
    }
}

import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;
import java.util.UUID;
import java.util.logging.Logger;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Mac;
import javax.crypto.BadPaddingException;
import java.nio.charset.StandardCharsets;

/**
 * Secure authentication service replacing deprecated Java 24 APIs with
 * supported, CVE-free alternatives. Implements HMAC signing for session tokens
 * and thread-safe date/time handling via java.time.
 */
public class SecureAuthService {
    private static final Logger LOGGER = Logger.getLogger(SecureAuthService.class.getName());
    private static final Base64.Encoder BASE64_ENCODER = Base64.getUrlEncoder().withoutPadding(); // Supported since Java 8
    private static final Base64.Decoder BASE64_DECODER = Base64.getUrlDecoder(); // Supported since Java 8
    private static final DateTimeFormatter TOKEN_DATE_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd-HH:mm"); // Thread-safe
    private static final Map SESSION_CACHE = new HashMap<>();
    private static final long SESSION_TTL_MS = 3_600_000; // 1 hour TTL
    private static final String HMAC_ALGORITHM = "HmacSHA256";
    private final SecretKey secretKey;

    /**
     * Initializes secure auth service with a 256-bit HMAC secret key.
     * @param secretKeyHex Hex-encoded 256-bit secret key for HMAC signing
     * @throws IllegalArgumentException if secret key is invalid length
     */
    public SecureAuthService(String secretKeyHex) {
        if (secretKeyHex == null || secretKeyHex.length() != 64) {
            throw new IllegalArgumentException("Secret key must be 64-character hex (256-bit)");
        }
        byte[] keyBytes = hexStringToBytes(secretKeyHex);
        this.secretKey = new SecretKeySpec(keyBytes, HMAC_ALGORITHM);
        LOGGER.info("Initialized SecureAuthService with HMAC-SHA256 signing");
    }

    /**
     * Generates a signed session token using supported Java 24 APIs.
     * @param userId Unique user identifier
     * @return Signed session token, or null if generation fails
     */
    public String generateSessionToken(String userId) {
        if (userId == null || userId.trim().isEmpty()) {
            LOGGER.warning("Attempted to generate session token for null/empty userId");
            return null;
        }

        try {
            // Thread-safe date/time handling via java.time (replaces deprecated java.util.Date)
            LocalDateTime now = LocalDateTime.now();
            String dateStr = now.format(TOKEN_DATE_FORMATTER);
            String tokenId = UUID.randomUUID().toString(); // Cryptographically secure random UUID

            // Token payload: userId|date|tokenId (no sensitive data)
            String tokenPayload = String.format("%s|%s|%s", userId, dateStr, tokenId);
            byte[] payloadBytes = tokenPayload.getBytes(StandardCharsets.UTF_8);

            // URL-safe Base64 encoding (replaces deprecated sun.misc.BASE64Encoder)
            String encodedPayload = BASE64_ENCODER.encodeToString(payloadBytes);

            // HMAC signing to prevent tampering (missing in vulnerable version)
            String signature = generateHmacSignature(encodedPayload);
            String fullToken = String.format("%s.%s", encodedPayload, signature);

            // Store with TTL to prevent cache overflow
            SESSION_CACHE.put(fullToken, userId);
            LOGGER.info(String.format("Generated secure session token for user %s", userId));
            return fullToken;
        } catch (NoSuchAlgorithmException e) {
            LOGGER.severe(String.format("HMAC algorithm %s not available: %s", HMAC_ALGORITHM, e.getMessage()));
            return null;
        } catch (InvalidKeyException e) {
            LOGGER.severe(String.format("Invalid secret key for HMAC: %s", e.getMessage()));
            return null;
        } catch (Exception e) {
            LOGGER.severe(String.format("Unexpected error generating token: %s", e.getMessage()));
            return null;
        }
    }

    /**
     * Validates a signed session token and checks TTL.
     * @param token Session token to validate
     * @return Associated userId if valid and not expired, null otherwise
     */
    public String validateSessionToken(String token) {
        if (token == null || token.trim().isEmpty()) {
            LOGGER.warning("Attempted to validate null/empty session token");
            return null;
        }

        try {
            // Split token into payload and signature
            String[] tokenParts = token.split("\\.");
            if (tokenParts.length != 2) {
                LOGGER.warning("Invalid token format: missing signature");
                return null;
            }

            String encodedPayload = tokenParts[0];
            String providedSignature = tokenParts[1];

            // Verify HMAC signature first (fail fast)
            String expectedSignature = generateHmacSignature(encodedPayload);
            if (!expectedSignature.equals(providedSignature)) {
                LOGGER.warning("Invalid token signature: tampering detected");
                return null;
            }

            // Decode payload (URL-safe Base64, replaces deprecated decodeBuffer)
            byte[] payloadBytes = BASE64_DECODER.decode(encodedPayload);
            String payload = new String(payloadBytes, StandardCharsets.UTF_8);
            String[] parts = payload.split("\\|");

            if (parts.length != 3) {
                LOGGER.warning(String.format("Invalid token payload format: %s", payload));
                return null;
            }

            // Check TTL (1 hour max age)
            String dateStr = parts[1];
            LocalDateTime tokenTime = LocalDateTime.parse(dateStr, TOKEN_DATE_FORMATTER);
            LocalDateTime now = LocalDateTime.now();
            if (tokenTime.plusMinutes(60).isBefore(now)) {
                LOGGER.warning(String.format("Expired token for user %s", parts[0]));
                SESSION_CACHE.remove(token); // Clean up expired token
                return null;
            }

            return SESSION_CACHE.get(token);
        } catch (IllegalArgumentException e) {
            LOGGER.warning(String.format("Invalid token encoding: %s", e.getMessage()));
            return null;
        } catch (Exception e) {
            LOGGER.severe(String.format("Unexpected error validating token: %s", e.getMessage()));
            return null;
        }
    }

    /**
     * Generates HMAC-SHA256 signature for a given payload.
     * @param payload Payload to sign
     * @return Hex-encoded HMAC signature
     */
    private String generateHmacSignature(String payload) throws NoSuchAlgorithmException, InvalidKeyException {
        Mac mac = Mac.getInstance(HMAC_ALGORITHM);
        mac.init(secretKey);
        byte[] signatureBytes = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
        return bytesToHexString(signatureBytes);
    }

    /**
     * Converts hex string to byte array.
     * @param hex Hex string to convert
     * @return Byte array, or empty array if invalid
     */
    private byte[] hexStringToBytes(String hex) {
        int len = hex.length();
        byte[] data = new byte[len / 2];
        for (int i = 0; i < len; i += 2) {
            data[i / 2] = (byte) ((Character.digit(hex.charAt(i), 16) << 4) + Character.digit(hex.charAt(i + 1), 16));
        }
        return data;
    }

    /**
     * Converts byte array to hex string.
     * @param bytes Byte array to convert
     * @return Hex-encoded string
     */
    private String bytesToHexString(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }

    public static void main(String[] args) {
        // Generate a test 256-bit secret key (in production, use secure key management)
        String testSecretKey = "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2";
        SecureAuthService service = new SecureAuthService(testSecretKey);
        String token = service.generateSessionToken("user-12345");
        System.out.println("Generated secure token: " + token);
        String userId = service.validateSessionToken(token);
        System.out.println("Validated userId: " + userId);
    }
}

import org.openjdk.jmh.annotations.*;
import org.openjdk.jmh.runner.Runner;
import org.openjdk.jmh.runner.RunnerException;
import org.openjdk.jmh.runner.options.Options;
import org.openjdk.jmh.runner.options.OptionsBuilder;
import sun.misc.BASE64Encoder; // Deprecated
import java.util.Base64;
import java.util.concurrent.TimeUnit;
import java.util.Date;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;

/**
 * JMH benchmark comparing deprecated Java 24 APIs vs supported alternatives.
 * Measures throughput and latency for Base64 encoding and date formatting operations.
 * Run with: java -jar benchmarks.jar -wi 5 -i 5 -f 1 -rf json
 */
@BenchmarkMode(Mode.Throughput)
@OutputTimeUnit(TimeUnit.MILLISECONDS)
@State(Scope.Thread)
@Fork(1)
@Warmup(iterations = 5, time = 1, timeUnit = TimeUnit.SECONDS)
@Measurement(iterations = 5, time = 1, timeUnit = TimeUnit.SECONDS)
public class ApiPerformanceBenchmark {
    private static final BASE64Encoder DEPRECATED_ENCODER = new BASE64Encoder();
    private static final Base64.Encoder SUPPORTED_ENCODER = Base64.getUrlEncoder().withoutPadding();
    private static final String TEST_PAYLOAD = "user-12345|2026-03-12|14:30";
    private static final DateTimeFormatter SUPPORTED_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd-HH:mm");
    private byte[] payloadBytes;

    @Setup
    public void setup() {
        payloadBytes = TEST_PAYLOAD.getBytes();
    }

    /**
     * Benchmarks deprecated sun.misc.BASE64Encoder encode method.
     */
    @Benchmark
    public String benchmarkDeprecatedBase64Encode() {
        return DEPRECATED_ENCODER.encode(payloadBytes);
    }

    /**
     * Benchmarks supported java.util.Base64 encode method.
     */
    @Benchmark
    public String benchmarkSupportedBase64Encode() {
        return SUPPORTED_ENCODER.encodeToString(payloadBytes);
    }

    /**
     * Benchmarks deprecated java.util.Date getYear() method.
     */
    @Benchmark
    public int benchmarkDeprecatedDateGetYear() {
        Date now = new Date();
        return now.getYear() + 1900; // Deprecated getYear()
    }

    /**
     * Benchmarks supported java.time.LocalDateTime getYear() method.
     */
    @Benchmark
    public int benchmarkSupportedLocalDateTimeGetYear() {
        LocalDateTime now = LocalDateTime.now();
        return now.getYear(); // Supported, thread-safe
    }

    /**
     * Benchmarks deprecated date formatting with SimpleDateFormat (not thread-safe).
     */
    @Benchmark
    public String benchmarkDeprecatedDateFormatter() throws Exception {
        Date now = new Date();
        SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd-HH:mm"); // Not thread-safe
        return sdf.format(now);
    }

    /**
     * Benchmarks supported date formatting with DateTimeFormatter (thread-safe).
     */
    @Benchmark
    public String benchmarkSupportedDateFormatter() {
        LocalDateTime now = LocalDateTime.now();
        return now.format(SUPPORTED_FORMATTER); // Thread-safe
    }

    public static void main(String[] args) throws RunnerException {
        Options opt = new OptionsBuilder()
                .include(ApiPerformanceBenchmark.class.getSimpleName())
                .build();
        new Runner(opt).run();
    }
}

// ArchUnit test to ban deprecated sun.misc imports
import com.tngtech.archunit.junit.AnalyzeClasses;
import com.tngtech.archunit.junit.ArchTest;
import com.tngunit.lang.ArchRule;
import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;

@AnalyzeClasses(packages = "com.example.payment")
public class DeprecatedApiRules {
    @ArchTest
    public static final ArchRule NO_SUN_MISC_IMPORTS = noClasses()
        .should().accessClassesThat().resideInAnyPackage("sun.misc..")
        .because("sun.misc APIs are deprecated in Java 24 and will be removed in Java 25");
}

// JMH benchmark to validate Base64 replacement performance
import org.openjdk.jmh.annotations.*;
import java.util.Base64;
import java.util.concurrent.TimeUnit;

@BenchmarkMode(Mode.Throughput)
@OutputTimeUnit(TimeUnit.MILLISECONDS)
public class Base64Benchmark {
    private static final String PAYLOAD = "test-payload-12345";
    private static final Base64.Encoder ENCODER = Base64.getUrlEncoder().withoutPadding();

    @Benchmark
    public byte[] benchmarkSupportedBase64() {
        return ENCODER.encode(PAYLOAD.getBytes());
    }
}

// Runtime guard for deprecated sun.misc.BASE64Encoder usage
import sun.misc.BASE64Encoder;
import java.util.logging.Logger;

public class GuardedBASE64Encoder extends BASE64Encoder {
    private static final Logger LOGGER = Logger.getLogger(GuardedBASE64Encoder.class.getName());

    @Override
    public String encode(byte[] data) {
        LOGGER.severe("Deprecated BASE64Encoder.encode() called in production! CVE-2023-25193 risk.");
        // In production, send alert to security team via webhook here
        return super.encode(data);
    }
}