GB/T 38674-2020Information security technology—Guideline on secure coding of application software (English PDF)
信息安全技术 应用软件安全编程指南
This is a limited preview
Buy now to download the full PDF (100 pages)
Need quotation for your management?
Get a formal quotation for GB/T 38674-2020 in 30 minutes.
Issued by
SAMR; SAC
Level / Type
National · Recommended
Issue date
April 28, 2020
Implementation date
November 1, 2020
Scope
GB/T 38674-2020 is the English-translated version of 信息安全技术 应用软件安全编程指南.
GB/T 38674-2020 is the Chinese standard "Information security technology—Guideline on secure coding of application software".
Its scope clause reads: This standard proposes a general framework for application software security programming, and conducts the application software programming process from the perspective of improving software security guide.
This standard is applicable to application software development of client/server architecture. Supplement the necessary safety protection measures according to the characteristics of its application environment. Its clauses include terms and definitions, abbreviations.
Found what you need?
Document preview — GB/T 38674-2020
National Standard of the People's Republic of China
- ICS
- 35.040
- Classification
- L 80
Issued by: State Administration for Market Regulation; Standardization Administration of the PRC
Contents
- Foreword I
- 1 Scope
- 2 Normative references
- 3 Terms and definitions, abbreviations
- 3.1 Terms and definitions
- 3.2 Acronyms
- 4 Overview
- 5 Safety function realization
- 5.1 Data cleaning
- 5.2 Data encryption and protection
- 5.3 Access Control
- 5.4 Log Security
- 6 Code for security
- 6.1 Object-oriented program security
- 6.2 Concurrent program security
- 6.3 Function call security
- 6.4 Exception handling security
- 6.5 Pointer safety
- 6.6 Code generation security
- 7 Resource Use Security
- 7.1 Resource management
- 7.2 Memory management
- 7.3 Database Management
- 7.4 File management
- 7.5 Network transmission
- 8 Environmental Security
- 8.1 Use of third-party software security
- 8.2 Development Environment Security
- 8.3 Operating Environment Safety
- Appendix A (Informative Appendix) Code Example
- References
1 Scope
This standard proposes a general framework for application software security programming, and conducts the application software programming process from the perspective of improving software security guide.
This standard is applicable to application software development of client/server architecture.
Supplement the necessary safety protection measures according to the characteristics of its application environment.
2 Normative references
The following documents are essential for the application of this document. For dated references, only the dated version applies to this article
Pieces. For the cited documents without date, the latest version (including all amendments) applies to this document.
GB/T 25069-2010 Information Security Technical Terms
3 Terms and definitions, abbreviations
3.1 Terms and definitions
The terms and definitions defined in GB/T 25069-2010 and the following apply to this document. For ease of use, the following list is repeated
Certain terms and definitions in GB/T 25069-2010.
3.1.1 Buffer overflow
Write content that exceeds the length of the program's buffer, thereby destroying the program stack and turning the program to execute other instructions to obtain the program
Control of the sequence or system.
3.1.2 Command injection
Through the application program, the malicious content input by the user is spliced into the command and submitted to the background engine to perform the attack.
3.1.3 Application software log
A collection of files used to record system operation events.
3.1.4 Threadsafe
When a function or function library is called in a multi-threaded environment, it can correctly handle shared variables between multiple threads to make the program function
Ability to execute correctly.
3.1.5 Threads synchronization
A mechanism by which multiple threads control the execution order between threads by specific means.
Note. When a thread is operating on memory, other threads cannot perform operations on the memory address until the thread operation is completed.
The thread is set to wait.
......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 100 pages — is available in the English PDF.
Referenced standards
Cited by
- GB/T 43441.2-2026Information technology - Digital twin - Part 2: Digital entity
- GB/T 45413-2025General technical requirements of water hammer monitoring system for water supply system
- GB/T 46499-2025Household electrical appliances - Monitoring of quality status in the manufacturing process - System architecture
- GB/T 20907-2024Technical specification for the automatic fare collection system of urban rail transit
- GB/T 42884-2023Information security technology—Guidelines for life cycle security management of mobile Internet applications (App)
Similar standards
How to Download GB/T 38674-2020
- 1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
- 2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
- 3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
- 4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.
Related Standards
GB/T 10003-2026 — Biaxially oriented polypropylene (BOPP) film
GB/T 10004-2026 — Plastic/Plastic laminated films and pouches for packaging
GB/T 10007-2026 — Rigid cellular plastics - Determination of shear properties
Secure payment via Stripe
Payments accepted
GB/T 38674-2020
$2,100.00