This code stores a reference to an externally mutable object into a static field. If unchecked changes to the mutable object would compromise security or other important properties, you will need to do something different. It may be possible for external code to inspect or change the value of the static field by holding a reference to it after passing it to this class.
A public static method returns a reference to an array that is part of the static state of the class. Any code that calls this method can freely modify the underlying array. This is dangerous because it could allow external code to modify the behavior of the class by changing data asssumed to be invariant.
The password field for this database connection is empty.
This code appears to use an XMLReader
instance without setting the correct input processing flags. This could allow XML External Entity (XXE) attacks to easily occur.
execute
or addBatch
method on an SQL statement JAVA-S0082The method invokes the execute
or addBatch
method on an SQL statement with a String
that seems to be dynamically generated. This can allow SQL injection attacks to occur.
A new cookie is created without the Secure
flag set to true
. The Secure
flag is a browser directive that prevents the cookie from being transmitted over insecure connections (http://
).
Basic authorization only encodes the user name and password in base-64 before sending it to the server, which is just a step above sending the data as plain-text.
A JNDI LDAP configuration was found where authentication was disabled.
This is highly discouraged, as it means the LDAP binding is accessible to any client that has its address.
An instance of a RandomUtil
implementation generated by JHipster was found which is unsuitable for cryptographic purposes.
Spring components should not introduced unmanaged state variables (fields not managed by Spring).
Spring request handlers should not allow persistent objects (@Entity
and @Document
) to be passed through arguments.
Parsing SAML comments should be disabled in applications using OpenSAML2.
getRequestSessionId
should not be used JAVA-S1063The session ID returned by getRequestSessionId
isn't necessarily the one belonging to the current user.
Avoid using unsanitized data from sources like incoming requests or sockets in network calls.
SSLContext should be initialized with "TLS"
in order to use more recent TLS versions. If SSL
is used instead as the protocol string, the implementation will default to an older, insecure version of TLS or SSL.
Intents that contain sensitive information should only be broadcast as explicit intents with tight control on what activities may receive them.
Avoid granting file access privileges to web views.
Do not grant JavaScript execution permissions to a web view unless absolutely required.
File.setWritable()
is invoked in a way that allows all users to write to a file. This may expose a security vulnerability in the application through that file.
Avoid creating Hibernate SQL queries with strings containing unsanitized input.