Secure Coding Practices¶

# Python: Demonstrates multiple security layers working together
def register_user(request_data):
    # Layer 1: Input validation - reject malformed data early
    validation_errors = validate_registration_data(request_data)
    if validation_errors:
        return {"status": "error", "errors": validation_errors}

    # Layer 2: Password strength enforcement
    if not password_meets_requirements(request_data["password"]):
        return {"status": "error", "message": "Password too weak"}

    # Layer 3: Secure password storage using adaptive hashing
    hashed_password = bcrypt.hashpw(
        request_data["password"].encode("utf-8"), 
        bcrypt.gensalt(rounds=12)
    )

    # Layer 4: SQL injection prevention via parameterized queries
    try:
        with db_connection() as conn:
            with conn.cursor() as cur:
                cur.execute(
                    "INSERT INTO users (username, email, password_hash) VALUES (%s, %s, %s)",
                    (request_data["username"], request_data["email"], hashed_password)
                )
    except IntegrityError:
        return {"status": "error", "message": "User already exists"}

    # Layer 5: Security event logging for detection and forensics
    security_logger.info(
        "New user registered", 
        extra={"username": request_data["username"], "email": request_data["email"]}
    )

    return {"status": "success", "message": "Registration successful"}

// JavaScript: Demonstrates multiple security layers working together
async function registerUser(userData) {
  try {
    // Layer 1: Input validation - reject malformed data early
    const validationErrors = validateRegistrationData(userData);
    if (validationErrors.length > 0) {
      return { status: 'error', errors: validationErrors };
    }

    // Layer 2: Password strength enforcement
    if (!passwordMeetsRequirements(userData.password)) {
      return { status: 'error', message: 'Password too weak' };
    }

    // Layer 3: Secure password storage using adaptive hashing
    const salt = await bcrypt.genSalt(12);
    const passwordHash = await bcrypt.hash(userData.password, salt);

    // Layer 4: SQL injection prevention via parameterized queries
    const result = await db.query(
      'INSERT INTO users (username, email, password_hash) VALUES (?, ?, ?)',
      [userData.username, userData.email, passwordHash]
    );

    // Layer 5: Security event logging for detection and forensics
    securityLogger.info('New user registered', {
      username: userData.username,
      email: userData.email,
      ipAddress: userData.ipAddress
    });

    return { status: 'success', message: 'Registration successful' };
  } catch (error) {
    if (error.code === 'ER_DUP_ENTRY') {
      return { status: 'error', message: 'User already exists' };
    }
    errorLogger.error('Registration error', { error: error.message });
    return { status: 'error', message: 'Registration failed' };
  }
}

// Java: Demonstrates multiple security layers working together
@Service
public class RegistrationService {

    @Autowired
    private UserRepository userRepository;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Autowired
    private SecurityAuditLogger securityLogger;

    public RegistrationResult registerUser(RegistrationRequest request) {
        // Layer 1: Input validation - reject malformed data early
        ValidationResult validation = validateRegistrationData(request);
        if (!validation.isValid()) {
            return RegistrationResult.error(validation.getErrors());
        }

        // Layer 2: Password strength enforcement
        if (!passwordMeetsRequirements(request.getPassword())) {
            return RegistrationResult.error("Password too weak");
        }

        // Layer 3: Secure password storage using adaptive hashing
        String hashedPassword = passwordEncoder.encode(request.getPassword());

        // Layer 4: Create user with secure defaults
        User user = new User();
        user.setUsername(request.getUsername());
        user.setEmail(request.getEmail());
        user.setPasswordHash(hashedPassword);
        user.setEnabled(false);  // Require email verification

        // Layer 5: SQL injection prevention (JPA uses parameterized queries)
        try {
            userRepository.save(user);
        } catch (DataIntegrityViolationException e) {
            return RegistrationResult.error("User already exists");
        }

        // Layer 6: Security event logging for detection and forensics
        securityLogger.logSecurityEvent(
            SecurityEventType.USER_REGISTRATION,
            request.getUsername(),
            request.getClientIp()
        );

        return RegistrationResult.success("Registration successful");
    }
}

# Python: Comprehensive validation pattern
import re
import html

def validate_user_profile(data):
    """Validate user profile data against defined rules"""
    errors = []

    # Required field validation
    if not data.get("username"):
        errors.append("Username is required")
    elif not re.match(r'^[a-zA-Z0-9_]{3,30}$', data.get("username", "")):
        errors.append("Username: 3-30 characters, letters/numbers/underscore only")

    # Email validation with specific pattern
    if not data.get("email"):
        errors.append("Email is required")
    elif not re.match(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$', 
                      data.get("email", "")):
        errors.append("Invalid email format")

    # Optional field with constraints
    if data.get("website"):
        if not re.match(r'^https?://[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(/.*)?$', 
                       data.get("website")):
            errors.append("Website must be valid URL (http/https)")

    # Length constraints on text fields
    if data.get("bio") and len(data.get("bio")) > 500:
        errors.append("Bio cannot exceed 500 characters")

    return errors

def sanitize_user_profile(data):
    """Sanitize data after validation passes"""
    sanitized = {}

    if "username" in data:
        sanitized["username"] = data["username"].strip()

    if "email" in data:
        sanitized["email"] = data["email"].strip().lower()

    if "bio" in data:
        # HTML escape to prevent XSS
        sanitized["bio"] = html.escape(data["bio"].strip())

    if "website" in data:
        website = data["website"].strip()
        if website and re.match(r'^https?://', website):
            sanitized["website"] = website

    return sanitized

def process_profile_update(raw_data):
    """Orchestrate validation and sanitization"""
    # First validate
    errors = validate_user_profile(raw_data)
    if errors:
        return {"status": "error", "errors": errors}

    # Then sanitize
    sanitized_data = sanitize_user_profile(raw_data)

    # Finally, save using parameterized queries (not shown)
    return {"status": "success", "profile": sanitized_data}

// JavaScript: Comprehensive validation pattern
class UserProfileValidator {
  static validate(data) {
    const errors = [];

    // Required field validation
    if (!data.username) {
      errors.push('Username is required');
    } else if (!/^[a-zA-Z0-9_]{3,30}$/.test(data.username)) {
      errors.push('Username: 3-30 characters, letters/numbers/underscore only');
    }

    // Email validation with specific pattern
    if (!data.email) {
      errors.push('Email is required');
    } else if (!/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(data.email)) {
      errors.push('Invalid email format');
    }

    // Optional field with constraints
    if (data.website && !/^https?:\/\/[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(\/.*)?$/.test(data.website)) {
      errors.push('Website must be valid URL (http/https)');
    }

    // Length constraints on text fields
    if (data.bio && data.bio.length > 500) {
      errors.push('Bio cannot exceed 500 characters');
    }

    return errors;
  }

  static sanitize(data) {
    const sanitized = {};

    if (data.username) {
      sanitized.username = data.username.trim();
    }

    if (data.email) {
      sanitized.email = data.email.trim().toLowerCase();
    }

    if (data.bio) {
      // Use DOMPurify to sanitize HTML content
      sanitized.bio = DOMPurify.sanitize(data.bio.trim(), {
        ALLOWED_TAGS: [],
        ALLOWED_ATTR: []
      });
    }

    if (data.website) {
      const website = data.website.trim();
      if (website && /^https?:\/\//.test(website)) {
        sanitized.website = website;
      }
    }

    return sanitized;
  }
}

async function processProfileUpdate(rawData) {
  // First validate
  const errors = UserProfileValidator.validate(rawData);
  if (errors.length > 0) {
    return { status: 'error', errors };
  }

  // Then sanitize
  const sanitizedData = UserProfileValidator.sanitize(rawData);

  try {
    // Finally, save using parameterized queries
    await db.query(
      'UPDATE user_profiles SET bio = ?, website = ? WHERE username = ?',
      [sanitizedData.bio, sanitizedData.website, sanitizedData.username]
    );

    return { status: 'success', profile: sanitizedData };
  } catch (error) {
    console.error('Profile update error:', error);
    return { status: 'error', message: 'Failed to update profile' };
  }
}

// Java: Comprehensive validation pattern
@Service
public class UserProfileService {

    @Autowired
    private UserProfileRepository repository;

    public class ValidationResult {
        private final List<String> errors = new ArrayList<>();

        public void addError(String error) {
            errors.add(error);
        }

        public boolean isValid() {
            return errors.isEmpty();
        }

        public List<String> getErrors() {
            return Collections.unmodifiableList(errors);
        }
    }

    public ValidationResult validateUserProfile(UserProfileDto dto) {
        ValidationResult result = new ValidationResult();

        // Required field validation
        if (StringUtils.isEmpty(dto.getUsername())) {
            result.addError("Username is required");
        } else if (!Pattern.matches("^[a-zA-Z0-9_]{3,30}$", dto.getUsername())) {
            result.addError("Username: 3-30 characters, letters/numbers/underscore only");
        }

        // Email validation with specific pattern
        if (StringUtils.isEmpty(dto.getEmail())) {
            result.addError("Email is required");
        } else if (!Pattern.matches("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", 
                                    dto.getEmail())) {
            result.addError("Invalid email format");
        }

        // Optional field with constraints
        if (StringUtils.hasText(dto.getWebsite()) && 
            !Pattern.matches("^https?://[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}(/.*)?$", 
                           dto.getWebsite())) {
            result.addError("Website must be valid URL (http/https)");
        }

        // Length constraints on text fields
        if (StringUtils.hasText(dto.getBio()) && dto.getBio().length() > 500) {
            result.addError("Bio cannot exceed 500 characters");
        }

        return result;
    }

    public UserProfile sanitizeAndCreateUserProfile(UserProfileDto dto) {
        UserProfile profile = new UserProfile();

        if (dto.getUsername() != null) {
            profile.setUsername(dto.getUsername().trim());
        }

        if (dto.getEmail() != null) {
            profile.setEmail(dto.getEmail().trim().toLowerCase());
        }

        if (dto.getBio() != null) {
            // HTML escape bio to prevent script injection
            String sanitizedBio = StringEscapeUtils.escapeHtml4(dto.getBio().trim());
            profile.setBio(sanitizedBio);
        }

        if (dto.getWebsite() != null) {
            String website = dto.getWebsite().trim();
            if (website.matches("^https?://.*")) {
                profile.setWebsite(website);
            }
        }

        return profile;
    }

    public ApiResponse processProfileUpdate(UserProfileDto dto) {
        // First validate
        ValidationResult validationResult = validateUserProfile(dto);
        if (!validationResult.isValid()) {
            return ApiResponse.error("Validation failed", validationResult.getErrors());
        }

        // Then sanitize
        UserProfile profile = sanitizeAndCreateUserProfile(dto);

        try {
            // Finally, save using JPA (parameterized queries automatic)
            repository.save(profile);
            return ApiResponse.success("Profile updated successfully", profile);
        } catch (Exception e) {
            log.error("Failed to update profile", e);
            return ApiResponse.error("Failed to update profile");
        }
    }
}

# Python (Flask): Context-aware output encoding
from flask import Flask, render_template_string, escape
import html
import json
import urllib.parse

app = Flask(__name__)

@app.route('/profile/<username>')
def profile(username):
    # Simulated user data (could contain malicious content)
    user = {
        'username': username,
        'bio': '<script>alert("XSS")</script>Normal bio text',
        'website': 'https://example.com',
        'favorite_color': 'red'
    }

    # Context 1: HTML body - HTML encoding
    html_safe_bio = html.escape(user['bio'])

    # Context 2: JavaScript - JSON encoding
    js_safe_data = json.dumps(user['bio'])

    # Context 3: URL - URL encoding
    url_safe_website = urllib.parse.quote(user['website'], safe=':/')

    # Context 4: CSS - escape special characters
    css_safe_color = user['favorite_color'].replace('"', '\\"').replace("'", "\\'")

    template = '''
    <!DOCTYPE html>
    <html>
    <head>
        <title>Profile: {{ username }}</title>
        <style>
            .user-badge { color: "{{ css_color }}"; }
        </style>
    </head>
    <body>
        <h1>{{ username }}'s Profile</h1>
        <!-- Jinja2 auto-escapes this -->
        <div class="bio">{{ bio }}</div>

        <!-- Manually escaped for demonstration -->
        <div class="bio-manual">{{ html_bio | safe }}</div>

        <a href="{{ website }}">Visit Website</a>

        <script>
            // JavaScript context requires JSON encoding
            const userBio = {{ js_bio | safe }};
            console.log('Bio length:', userBio.length);
        </script>
    </body>
    </html>
    '''

    return render_template_string(
        template,
        username=username,
        bio=user['bio'],  # Jinja2 auto-escapes
        html_bio=html_safe_bio,
        js_bio=js_safe_data,
        website=url_safe_website,
        css_color=css_safe_color
    )

# Add security headers
@app.after_request
def add_security_headers(response):
    response.headers['Content-Security-Policy'] = "default-src 'self'; script-src 'self'"
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    return response

// JavaScript (Express with EJS): Context-aware output encoding
const express = require('express');
const he = require('he');  // HTML entity encoder
const sanitizeHtml = require('sanitize-html');

const app = express();
app.set('view engine', 'ejs');

// Security headers middleware
app.use((req, res, next) => {
  res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self'");
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  next();
});

app.get('/profile/:username', (req, res) => {
  // Simulated user data (could contain malicious content)
  const user = {
    username: req.params.username,
    bio: '<script>alert("XSS")</script>Normal bio text',
    website: 'https://example.com',
    favoriteColor: 'red'
  };

  // Context 1: HTML body - HTML encoding
  const htmlSafeBio = he.encode(user.bio);

  // Context 2: JavaScript - JSON encoding
  const jsSafeData = JSON.stringify(user.bio);

  // Context 3: URL - URL encoding
  const urlSafeWebsite = encodeURIComponent(user.website);

  // Context 4: Sanitized HTML (allow limited tags)
  const sanitizedBio = sanitizeHtml(user.bio, {
    allowedTags: ['b', 'i', 'em', 'strong', 'a', 'p'],
    allowedAttributes: {
      'a': ['href']
    },
    allowedSchemes: ['http', 'https']
  });

  res.render('profile', {
    username: user.username,
    htmlSafeBio,
    jsSafeData,
    urlSafeWebsite,
    sanitizedBio
  });
});

// EJS template structure:
/*
<!DOCTYPE html>
<html>
<head>
    <title>Profile: <%= username %></title>
</head>
<body>
    <h1><%= username %>'s Profile</h1>

    <!-- EJS auto-escapes with <%= %> -->
    <div class="bio"><%= htmlSafeBio %></div>

    <!-- Sanitized HTML with <%- %> (unescaped) -->
    <div class="rich-bio"><%- sanitizedBio %></div>

    <a href="<%= urlSafeWebsite %>">Visit Website</a>

    <script>
        const userBio = <%- jsSafeData %>;
        console.log('Bio length:', userBio.length);
    </script>
</body>
</html>
*/

// Java (Spring with Thymeleaf): Context-aware output encoding
@Controller
public class ProfileController {

    @Autowired
    private UserProfileService userProfileService;

    @GetMapping("/profile/{username}")
    public String profile(@PathVariable String username, Model model) throws Exception {

        // Simulated user data (could contain malicious content)
        UserProfile user = new UserProfile();
        user.setUsername(username);
        user.setBio("<script>alert('XSS')</script>Normal bio text");
        user.setWebsite("https://example.com");
        user.setFavoriteColor("red");

        // Thymeleaf handles HTML encoding automatically for th:text
        model.addAttribute("user", user);

        // For JavaScript context, prepare JSON
        ObjectMapper mapper = new ObjectMapper();
        String userBioJson = mapper.writeValueAsString(user.getBio());
        model.addAttribute("userBioJson", userBioJson);

        // For URL context
        String encodedWebsite = URLEncoder.encode(
            user.getWebsite(), 
            StandardCharsets.UTF_8.toString()
        );
        model.addAttribute("encodedWebsite", encodedWebsite);

        // For rich text, sanitize using jsoup
        String sanitizedBio = Jsoup.clean(user.getBio(), Safelist.basic());
        model.addAttribute("sanitizedBio", sanitizedBio);

        return "profile";
    }
}

// Thymeleaf template (profile.html):
/*
<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <title th:text="'Profile: ' + ${user.username}">Profile</title>
</head>
<body>
    <h1 th:text="${user.username} + '''s Profile'">Profile</h1>

    <!-- Thymeleaf th:text automatically HTML-escapes -->
    <div class="bio" th:text="${user.bio}">Bio</div>

    <!-- For pre-sanitized HTML, use th:utext (unescaped) -->
    <div class="rich-bio" th:utext="${sanitizedBio}">Bio</div>

    <a th:href="${encodedWebsite}" target="_blank">Visit Website</a>

    <script th:inline="javascript">
        /*<![CDATA[*/
        // Thymeleaf properly escapes JavaScript context
        const userBio = /*[[${userBioJson}]]*/ '';
        console.log('Bio length:', userBio.length);
        /*]]>*/
    </script>
</body>
</html>
*/

// Security headers configuration
@Configuration
public class WebSecurityConfig {

    @Bean
    public WebMvcConfigurer webMvcConfigurer() {
        return new WebMvcConfigurer() {
            @Override
            public void addInterceptors(InterceptorRegistry registry) {
                registry.addInterceptor(new SecurityHeadersInterceptor());
            }
        };
    }

    public class SecurityHeadersInterceptor implements HandlerInterceptor {
        @Override
        public boolean preHandle(HttpServletRequest request, 
                                HttpServletResponse response, 
                                Object handler) {
            response.setHeader("Content-Security-Policy", 
                             "default-src 'self'; script-src 'self'");
            response.setHeader("X-Content-Type-Options", "nosniff");
            response.setHeader("X-Frame-Options", "DENY");
            return true;
        }
    }
}

# Python: Secure handling of sensitive data
import os
import bcrypt
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import base64

class SecretManager:
    """Secure secret management"""

    @staticmethod
    def get_secret(key, default=None):
        """Retrieve secret from environment or vault"""
        # Priority 1: Environment variables
        value = os.environ.get(key)
        if value:
            return value

        # Priority 2: Secret management service (AWS Secrets Manager, HashiCorp Vault)
        # This is a placeholder - implement actual vault integration
        try:
            from vault_client import get_secret
            return get_secret(key)
        except ImportError:
            return default

class PasswordManager:
    """Secure password hashing and verification"""

    @staticmethod
    def hash_password(password):
        """Hash password using bcrypt"""
        salt = bcrypt.gensalt(rounds=12)
        return bcrypt.hashpw(password.encode('utf-8'), salt).decode('utf-8')

    @staticmethod
    def verify_password(stored_hash, provided_password):
        """Verify password against stored hash"""
        return bcrypt.checkpw(
            provided_password.encode('utf-8'),
            stored_hash.encode('utf-8')
        )

class DataEncryptor:
    """Field-level encryption for sensitive data"""

    def __init__(self):
        # Get encryption key from secure storage
        encryption_key = SecretManager.get_secret("DATA_ENCRYPTION_KEY")
        if not encryption_key:
            raise ValueError("Encryption key not configured")

        # Derive a proper Fernet key
        salt = SecretManager.get_secret("ENCRYPTION_SALT").encode()
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            iterations=100000,
        )
        key = base64.urlsafe_b64encode(kdf.derive(encryption_key.encode()))
        self.fernet = Fernet(key)

    def encrypt(self, plaintext):
        """Encrypt sensitive data"""
        if plaintext is None:
            return None
        return self.fernet.encrypt(plaintext.encode('utf-8')).decode('utf-8')

    def decrypt(self, ciphertext):
        """Decrypt sensitive data"""
        if ciphertext is None:
            return None
        return self.fernet.decrypt(ciphertext.encode('utf-8')).decode('utf-8')

    def encrypt_fields(self, data, sensitive_fields):
        """Encrypt specific fields in a dictionary"""
        result = data.copy()
        for field in sensitive_fields:
            if field in result and result[field]:
                result[field] = self.encrypt(str(result[field]))
        return result

    def decrypt_fields(self, data, sensitive_fields):
        """Decrypt specific fields in a dictionary"""
        result = data.copy()
        for field in sensitive_fields:
            if field in result and result[field]:
                result[field] = self.decrypt(result[field])
        return result

# Usage example
class UserDataService:
    """Service with secure data handling"""

    SENSITIVE_FIELDS = ['ssn', 'credit_card', 'address']

    def __init__(self):
        self.encryptor = DataEncryptor()

    def save_user_data(self, user_id, user_data):
        """Save user data with encrypted sensitive fields"""
        # Encrypt sensitive fields
        encrypted_data = self.encryptor.encrypt_fields(
            user_data, 
            self.SENSITIVE_FIELDS
        )

        # Save to database using parameterized queries
        db.execute(
            "INSERT INTO users (id, name, email, ssn, credit_card) VALUES (%s, %s, %s, %s, %s)",
            (user_id, encrypted_data['name'], encrypted_data['email'], 
             encrypted_data['ssn'], encrypted_data['credit_card'])
        )

        # Audit log (without sensitive data)
        audit_log.info(f"User data saved for user_id: {user_id}")

    def get_user_data(self, user_id, requesting_user_id):
        """Retrieve and decrypt user data with access control"""
        # Check access permission
        if not self._can_access(requesting_user_id, user_id):
            raise PermissionError("Unauthorized access")

        # Retrieve encrypted data
        encrypted_data = db.fetch_one(
            "SELECT * FROM users WHERE id = %s", (user_id,)
        )

        # Decrypt sensitive fields
        decrypted_data = self.encryptor.decrypt_fields(
            encrypted_data,
            self.SENSITIVE_FIELDS
        )

        # Audit log
        audit_log.info(
            f"User data accessed: user_id={user_id}, accessed_by={requesting_user_id}"
        )

        return decrypted_data

    def _can_access(self, requesting_user_id, target_user_id):
        """Check if user has permission to access data"""
        # Self-access allowed
        if requesting_user_id == target_user_id:
            return True

        # Check role-based permissions
        roles = db.fetch_user_roles(requesting_user_id)
        return 'admin' in roles or 'support' in roles

// JavaScript: Secure handling of sensitive data
const crypto = require('crypto');
const bcrypt = require('bcrypt');

class SecretManager {
  /**
   * Secure secret management
   */
  static getSecret(key, defaultValue = null) {
    // Priority 1: Environment variables
    const value = process.env[key];
    if (value) {
      return value;
    }

    // Priority 2: Secret management service
    // Implement vault integration here
    try {
      const { getSecret } = require('./vaultClient');
      return getSecret(key);
    } catch (err) {
      return defaultValue;
    }
  }
}

class PasswordManager {
  /**
   * Secure password hashing and verification
   */
  static async hashPassword(password) {
    const salt = await bcrypt.genSalt(12);
    return bcrypt.hash(password, salt);
  }

  static async verifyPassword(storedHash, providedPassword) {
    return bcrypt.compare(providedPassword, storedHash);
  }
}

class DataEncryptor {
  /**
   * Field-level encryption for sensitive data
   */
  constructor() {
    // Get encryption key from secure storage
    this.encryptionKey = SecretManager.getSecret('DATA_ENCRYPTION_KEY');
    if (!this.encryptionKey) {
      throw new Error('Encryption key not configured');
    }

    // Convert to Buffer
    this.key = Buffer.from(this.encryptionKey, 'hex');
    this.algorithm = 'aes-256-gcm';
    this.ivLength = 16;
  }

  encrypt(plaintext) {
    if (!plaintext) return null;

    const text = typeof plaintext === 'string' ? plaintext : JSON.stringify(plaintext);

    // Generate random IV
    const iv = crypto.randomBytes(this.ivLength);

    // Create cipher
    const cipher = crypto.createCipheriv(this.algorithm, this.key, iv);

    // Encrypt
    let encrypted = cipher.update(text, 'utf8', 'hex');
    encrypted += cipher.final('hex');

    // Get auth tag
    const authTag = cipher.getAuthTag();

    // Combine IV, auth tag, and encrypted data
    return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
  }

  decrypt(ciphertext) {
    if (!ciphertext) return null;

    // Split components
    const [ivHex, authTagHex, encrypted] = ciphertext.split(':');

    const iv = Buffer.from(ivHex, 'hex');
    const authTag = Buffer.from(authTagHex, 'hex');

    // Create decipher
    const decipher = crypto.createDecipheriv(this.algorithm, this.key, iv);
    decipher.setAuthTag(authTag);

    // Decrypt
    let decrypted = decipher.update(encrypted, 'hex', 'utf8');
    decrypted += decipher.final('utf8');

    return decrypted;
  }

  encryptFields(data, sensitiveFields) {
    const result = { ...data };
    for (const field of sensitiveFields) {
      if (result[field]) {
        result[field] = this.encrypt(result[field]);
      }
    }
    return result;
  }

  decryptFields(data, sensitiveFields) {
    const result = { ...data };
    for (const field of sensitiveFields) {
      if (result[field]) {
        result[field] = this.decrypt(result[field]);
      }
    }
    return result;
  }
}

// Usage example
class UserDataService {
  constructor(db, auditLog) {
    this.db = db;
    this.auditLog = auditLog;
    this.encryptor = new DataEncryptor();
    this.sensitiveFields = ['ssn', 'creditCard', 'address'];
  }

  async saveUserData(userId, userData) {
    // Encrypt sensitive fields
    const encryptedData = this.encryptor.encryptFields(
      userData,
      this.sensitiveFields
    );

    // Save to database using parameterized queries
    await this.db.query(
      'INSERT INTO users (id, name, email, ssn, credit_card) VALUES (?, ?, ?, ?, ?)',
      [userId, encryptedData.name, encryptedData.email, 
       encryptedData.ssn, encryptedData.creditCard]
    );

    // Audit log (without sensitive data)
    await this.auditLog.info(`User data saved for user_id: ${userId}`);
  }

  async getUserData(userId, requestingUserId) {
    // Check access permission
    if (!await this._canAccess(requestingUserId, userId)) {
      throw new Error('Unauthorized access');
    }

    // Retrieve encrypted data
    const encryptedData = await this.db.query(
      'SELECT * FROM users WHERE id = ?',
      [userId]
    );

    // Decrypt sensitive fields
    const decryptedData = this.encryptor.decryptFields(
      encryptedData[0],
      this.sensitiveFields
    );

    // Audit log
    await this.auditLog.info(
      `User data accessed: user_id=${userId}, accessed_by=${requestingUserId}`
    );

    return decryptedData;
  }

  async _canAccess(requestingUserId, targetUserId) {
    // Self-access allowed
    if (requestingUserId === targetUserId) {
      return true;
    }

    // Check role-based permissions
    const roles = await this.db.fetchUserRoles(requestingUserId);
    return roles.includes('admin') || roles.includes('support');
  }
}

// Java: Secure handling of sensitive data
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.ByteBuffer;
import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;
import java.util.*;

@Service
public class SensitiveDataHandler {

    private static final String ALGORITHM = "AES/GCM/NoPadding";
    private static final int GCM_IV_LENGTH = 12;
    private static final int GCM_TAG_LENGTH = 16;

    @Autowired
    private SecretManager secretManager;

    @Autowired
    private BCryptPasswordEncoder passwordEncoder;

    /**
     * Password hashing and verification
     */
    public String hashPassword(String password) {
        return passwordEncoder.encode(password);
    }

    public boolean verifyPassword(String storedHash, String providedPassword) {
        return passwordEncoder.matches(providedPassword, storedHash);
    }

    /**
     * Field-level encryption for sensitive data
     */
    public String encryptData(String plaintext) throws Exception {
        if (plaintext == null) {
            return null;
        }

        // Get encryption key from secure storage
        byte[] key = secretManager.getSecretAsBytes("DATA_ENCRYPTION_KEY");
        SecretKey secretKey = new SecretKeySpec(key, "AES");

        // Generate random IV
        byte[] iv = new byte[GCM_IV_LENGTH];
        new SecureRandom().nextBytes(iv);

        // Create GCM parameters
        GCMParameterSpec parameterSpec = new GCMParameterSpec(GCM_TAG_LENGTH * 8, iv);

        // Initialize cipher for encryption
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, parameterSpec);

        // Encrypt
        byte[] encryptedData = cipher.doFinal(
            plaintext.getBytes(StandardCharsets.UTF_8)
        );

        // Combine IV and encrypted data
        ByteBuffer byteBuffer = ByteBuffer.allocate(iv.length + encryptedData.length);
        byteBuffer.put(iv);
        byteBuffer.put(encryptedData);

        // Encode as Base64 for storage
        return Base64.getEncoder().encodeToString(byteBuffer.array());
    }

    public String decryptData(String encryptedData) throws Exception {
        if (encryptedData == null) {
            return null;
        }

        // Decode from Base64
        byte[] encryptedBytes = Base64.getDecoder().decode(encryptedData);

        // Extract IV and cipher text
        ByteBuffer byteBuffer = ByteBuffer.wrap(encryptedBytes);
        byte[] iv = new byte[GCM_IV_LENGTH];
        byteBuffer.get(iv);

        byte[] cipherText = new byte[byteBuffer.remaining()];
        byteBuffer.get(cipherText);

        // Get encryption key
        byte[] key = secretManager.getSecretAsBytes("DATA_ENCRYPTION_KEY");
        SecretKey secretKey = new SecretKeySpec(key, "AES");

        // Create GCM parameters
        GCMParameterSpec parameterSpec = new GCMParameterSpec(GCM_TAG_LENGTH * 8, iv);

        // Initialize cipher for decryption
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, secretKey, parameterSpec);

        // Decrypt
        byte[] decryptedData = cipher.doFinal(cipherText);

        return new String(decryptedData, StandardCharsets.UTF_8);
    }

    public Map<String, Object> encryptFields(Map<String, Object> data, 
                                            Set<String> sensitiveFields) 
                                            throws Exception {
        Map<String, Object> result = new HashMap<>(data);

        for (String field : sensitiveFields) {
            if (result.containsKey(field) && result.get(field) != null) {
                String fieldValue = String.valueOf(result.get(field));
                result.put(field, encryptData(fieldValue));
            }
        }

        return result;
    }

    public Map<String, Object> decryptFields(Map<String, Object> data, 
                                            Set<String> sensitiveFields) 
                                            throws Exception {
        Map<String, Object> result = new HashMap<>(data);

        for (String field : sensitiveFields) {
            if (result.containsKey(field) && result.get(field) != null) {
                String fieldValue = String.valueOf(result.get(field));
                result.put(field, decryptData(fieldValue));
            }
        }

        return result;
    }
}

// Usage example
@Service
public class UserDataService {

    private static final Set<String> SENSITIVE_FIELDS = Set.of(
        "ssn", "creditCard", "address"
    );

    @Autowired
    private UserRepository userRepository;

    @Autowired
    private SensitiveDataHandler sensitiveDataHandler;

    @Autowired
    private PermissionService permissionService;

    @Autowired
    private AuditLogger auditLogger;

    public UserData saveUserData(String userId, UserData userData, String operatorId) 
                                throws Exception {
        // Check permissions
        if (!permissionService.canModifyUser(operatorId, userId)) {
            throw new AccessDeniedException("Unauthorized access");
        }

        // Convert to map for encryption
        Map<String, Object> dataMap = userData.toMap();

        // Encrypt sensitive fields
        Map<String, Object> encryptedMap = sensitiveDataHandler.encryptFields(
            dataMap, 
            SENSITIVE_FIELDS
        );

        // Convert back to entity
        UserData encryptedData = UserData.fromMap(encryptedMap);

        // Save to database using parameterized queries (JPA handles this)
        UserData saved = userRepository.save(encryptedData);

        // Audit log (without sensitive data)
        auditLogger.log(AuditEvent.builder()
            .action("SAVE_USER_DATA")
            .resource("USER")
            .resourceId(userId)
            .operator(operatorId)
            .build());

        return saved;
    }

    public UserData getUserData(String userId, String requestingUserId) 
                               throws Exception {
        // Check permissions
        if (!permissionService.canViewUser(requestingUserId, userId)) {
            throw new AccessDeniedException("Unauthorized access");
        }

        // Retrieve encrypted data
        UserData encryptedData = userRepository.findById(userId)
            .orElseThrow(() -> new NotFoundException("User not found"));

        // Convert to map for decryption
        Map<String, Object> encryptedMap = encryptedData.toMap();

        // Decrypt sensitive fields
        Map<String, Object> decryptedMap = sensitiveDataHandler.decryptFields(
            encryptedMap,
            SENSITIVE_FIELDS
        );

        // Convert back to entity
        UserData decryptedData = UserData.fromMap(decryptedMap);

        // Audit log
        auditLogger.log(AuditEvent.builder()
            .action("VIEW_USER_DATA")
            .resource("USER")
            .resourceId(userId)
            .operator(requestingUserId)
            .build());

        return decryptedData;
    }
}