ISU Marketplace

Archived collaborative project (2026). ISU Marketplace is preserved as a historical secure-coding and portfolio artifact. It is not actively maintained or intended for production use.

ISU Marketplace is a local Java command-line application for listing, discovering, and purchasing marketplace items. The project was built around Common Weakness Enumeration (CWE) analysis: the team identified relevant weakness classes and implemented controls for authentication, authorization, database access, logging, resource handling, and input validation.

What it demonstrates

• Plain Java application design without a web framework
• SQLite persistence through JDBC and prepared statements
• BCrypt password hashing
• Member and administrator roles
• Registration and login-attempt controls
• Listing creation, removal, browsing, searching, and purchasing
• Administrator workflows for user roles, users, and listings
• Defensive input handling, identifier sanitization in authentication/account logs, query timeouts, and resource cleanup
• Cross-platform shell and Windows launch scripts

Security-focused implementation

The source documents the assignment's CWE analysis alongside the relevant controls. Notable examples include:

• Credential storage: passwords are hashed with BCrypt rather than stored directly.
• SQL injection resistance: user and listing operations use prepared statements for untrusted values.
• Authorization: administrator operations perform explicit role checks.
• Login abuse controls: repeated failed login attempts trigger an application-level lockout.
• Log injection resistance: the user handler normalizes identifiers used in authentication and account-management log messages.
• Resource management: JDBC statements, readers, and other resources use scoped cleanup.
• Predictable privileges: normal registration always creates a member account.
• Bootstrap safety: the archive no longer creates fixed-password administrator accounts; an administrator is created only when both bootstrap environment variables are supplied for an empty database.

These controls are educational examples, not a claim that the application has received a professional security audit.

System shape

Terminal input
    │
    ▼
InputController and InputValidation
    │
    ├── UserHandler ─── BCrypt authentication and role management
    │
    └── ListingHandler ─── listing and purchase operations
             │
             ▼
       SQLite databases

Historical reproduction

Requirements

• JDK 25 (the verified archive runtime)
• Bash on macOS/Linux, or Command Prompt on Windows

The required dependency JARs are preserved under lib/ so the historical scripts can compile and run without a separate build tool.

macOS/Linux

chmod +x run.sh
./run.sh

Windows

run.cmd

On first launch, the application creates local SQLite databases under db/ and 1 MB bounded local log files under logs/. Those runtime files are ignored by Git.

Optional administrator bootstrap

Normal users can register without additional configuration. To exercise administrator features on a new database, provide a non-default username and password before the first launch. Replace both CHANGE_ME values from the example; do not source it unchanged.

On macOS/Linux:

cp .env.example .env
set -a
. ./.env
set +a
./run.sh

On Windows Command Prompt:

set ISU_MARKETPLACE_ADMIN_USERNAME=portfolio-admin
set ISU_MARKETPLACE_ADMIN_PASSWORD=replace-with-a-long-local-password
run.cmd

Bootstrap configuration is read only when the user database is empty. Delete the local db/ directory if you intentionally want a fresh demonstration database.

Preserved dependencies

Library	Version	Purpose
Xerial SQLite JDBC	3.51.3.0	Embedded SQLite access
bcrypt	0.10.2	Password hashing and verification
bytes	1.6.1	bcrypt supporting library
JSON.simple	1.1.1	Reading the local configuration file

Historical limitations

• The repository has no automated test suite or continuous integration workflow.
• Dependencies are committed as JAR files instead of being managed through Maven or Gradle.
• The lockout counter is process-local rather than a durable or per-account production control.
• SQLite data and application logs are local to one workstation.
• The application models a purchase by updating local marketplace state; it does not process payments.
• The dependency snapshot is frozen and should be audited before reuse.

Project context and attribution

ISU Marketplace was developed collaboratively by @itsreverence, @PMarr62, @szyluc, @ShadyBradyB, and @kjkrahulik. The repository history preserves the implementation and collaboration record.

License

ISU Marketplace is available under the MIT License. The repository owner confirmed that the copyright contributors authorized this repository-wide license. Bundled third-party JARs remain subject to their respective licenses.