java.config

# Input and Output Streams
\bFileInputStream\b
\bObjectInputStream\b
\bFilterInputStream\b
\bPipedInputStream\b
\bSequenceInputStream\b
\bStringBufferInputStream\b
\bBufferedReader\b
\bByteArrayInputStream\b
\bjava\.io\.FileOutputStream\b
\bFile\b
\bObjectInputStream\b
\bPipedInputStream\b
\bStreamTokenizer\b
\bgetResourceAsStream\b
\bjava\.io\.FileReader\b
\bjava\.io\.FileWriter\b
\bjava\.io\.RandomAccessFile\b
\bjava\.io\.File\b
\brenameTo\b
\bMkdir\b

# Servlets
\bjavax\.servlet\.\w+
\bgetParameterNames\b
\bgetParameterValues\b
\bgetParameter\b
\bgetParameterMap\b
\bgetScheme\b
\bgetProtocol\b
\bgetContentType\b
\bgetServerName\b
\bgetRemoteAddr\b
\bgetRemoteHost\b
\bgetRealPath\b
\bgetLocalName\b
\bgetAttribute\b
\bgetAttributeNames\b
\bgetLocalAddr\b
\bgetAuthType\b
\bgetRemoteUser\b
\bgetCookies\b
\bisSecure\b
\bHttpServletRequest\b
\bgetQueryString\b
\bgetHeaderNames\b
\bgetHeaders\b
\bgetPrincipal\b
\bgetUserPrincipal\b
\bisUserInRole\b
\bgetInputStream\b
\bgetOutputStream\b
\bgetWriter\b
\baddCookie\b
\baddHeader\b
\bsetHeader\b
\bsetAttribute\b
\bputValue\b
\bjavax\.servlet\.http\.Cookie\b
\bgetName\b
\bgetPath\b
\bgetDomain\b
\bgetComment\b
\bgetMethod\b
\bgetPath\b
\bgetReader\b
\bgetRealPath\b
\bgetRequestURI\b
\bgetRequestURL\b
\bgetServerName\b
\bgetValue\b
\bgetValueNames\b
\bgetRequestedSessionId\b

# Cross Site Scripting
\bjavax\.servlet\.ServletOutputStream\.print\b
\bstrcpy\b

# Response splitting
\bjavax\.servlet\.http\.HttpServletResponse\.sendRedirect\b
\bstrcpy\b
\bsetHeader\b

# Redirection
\bsendRedirect\b
\bsetStatus\b
\baddHeader\b
\betHeader\b

# SQL and Database
\bjava\.sql\.Connection\.prepareStatement\b
\bjava\.sql\.ResultSet\.getObject\b
\bjava\.sql\.Statement\.executeUpdate\b
\bjava\.sql\.Statement\.addBatch\b
\bexecute\b
\bexecutestatement\b
\bcreateStatement\b
\bjava\.sql\.ResultSet\.getString\b
\bexecuteQuery\b
\bjdbc\b
\bjava\.sql\.Statement\.executeQuery\b
\bjava\.sql\.Statement\.execute\b
\bjava\.sql\.Connection\.prepareCall\b

# SSL
\bcom\.sun\.net\.ssl\b
\bSSLContext\b
\bSSLSocketFactory\b
\bTrustManagerFactory\b
\bHttpsURLConnection\b
\bKeyManagerFactory\b

# Session management
\bgetSession\b
\binvalidate\b
\bgetId\b

# Legacy Interaction
\bjava\.lang\.Runtime\.exec\b
\bjava\.lang\.Runtime\.getRuntime\b
\bgetId\b

# Logging
\bjava\.io\.PrintStream\.write\b
\blog4j\b
\bjLo\b
\bLumberjack\b
\bMonoLog\b
\bqflog\b
\bjust4log\b
\blog4Ant\b
\bJDLabAgent\b

# Ajax and javascript
\bdocument.write\b
\beval\b
\bdocument.cookie\b
\bwindow.location\b
\bdocument.URL\b

# Serialization
\bXMLdecoder\b
\bfromXML\b
\breadObject\b
\breadObjectNodData\b
\breadResolve\b
\breadExternal\b
\breadUnshared\b
\bSerializable\b