Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@ <h2>Why is this an issue?</h2>
<p>In software development, logs serve as a record of events within an application, providing crucial insights for debugging. When logging, it is
essential to ensure that the logs are:</p>
<ul>
<li> easily accessible </li>
<li> uniformly formatted for readability </li>
<li> properly recorded </li>
<li> securely logged when dealing with sensitive data </li>
<li>easily accessible</li>
<li>uniformly formatted for readability</li>
<li>properly recorded</li>
<li>securely logged when dealing with sensitive data</li>
</ul>
<p>Those requirements are not met if a program directly writes to the standard outputs (e.g., System.out, System.err, IO). That is why defining and
using a dedicated logger is highly recommended.</p>
Expand Down Expand Up @@ -36,12 +36,11 @@ <h3>Code examples</h3>
<h2>Resources</h2>
<h3>Documentation</h3>
<ul>
<li> <a href="https://docs.oracle.com/javase/7/docs/api/java/util/logging/Logger.html">Java SE 7 API Specification: java.util.logging.Logger</a>
</li>
<li> OWASP - <a href="https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/">Top 10 2021 Category A9 - Security Logging and
Monitoring Failures</a> </li>
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
Exposure</a> </li>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/nzdGBQ">CERT, ERR02-J.</a> - Prevent exceptions while logging data </li>
<li><a href="https://docs.oracle.com/javase/7/docs/api/java/util/logging/Logger.html">Java SE 7 API Specification: java.util.logging.Logger</a></li>
<li>OWASP - <a href="https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/">Top 10 2021 Category A9 - Security Logging and
Monitoring Failures</a></li>
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
Exposure</a></li>
<li><a href="https://wiki.sei.cmu.edu/confluence/x/nzdGBQ">CERT, ERR02-J.</a> - Prevent exceptions while logging data</li>
</ul>

Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@ <h3>Compliant solution</h3>
</pre>
<h2>Resources</h2>
<ul>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/5dUxBQ">CERT, MSC12-C.</a> - Detect and remove code that has no effect or is never executed
</li>
<li><a href="https://wiki.sei.cmu.edu/confluence/x/5dUxBQ">CERT, MSC12-C.</a> - Detect and remove code that has no effect or is never executed</li>
</ul>

Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ <h2>Why is this an issue?</h2>
<h3>Exceptions</h3>
<p>The rule admits 3 exceptions:</p>
<ul>
<li> Serialization ID fields </li>
<li>Serialization ID fields</li>
</ul>
<p>The Java serialization runtime associates with each serializable class a version number called <code>serialVersionUID</code>, which is used during
deserialization to verify that the sender and receiver of a serialized object have loaded classes for that object that are compatible for
Expand All @@ -30,7 +30,7 @@ <h3>Exceptions</h3>
}
</pre>
<ul>
<li> Annotated fields and classes annotated with Lombok annotations </li>
<li>Annotated fields and classes annotated with Lombok annotations</li>
</ul>
<p>The unused field in this class will not be reported by the rule as it is annotated, except if annotation class <code>SomeAnnotation</code> is
listed in the <code>ignoreAnnotations</code> parameter (see Parameters).</p>
Expand All @@ -41,7 +41,7 @@ <h3>Exceptions</h3>
}
</pre>
<ul>
<li> Fields from classes with native methods </li>
<li>Fields from classes with native methods</li>
</ul>
<p>The unused field in this class will not be reported by the rule as it might be used by native code.</p>
<pre>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ <h2>Why is this an issue?</h2>
</pre>
<p>The solution can be to:</p>
<ul>
<li> Split the method into smaller ones </li>
<li>Split the method into smaller ones</li>
</ul>
<pre>
// Each function does a part of what the original setCoordinates function was doing, so confusion risks are lower
Expand All @@ -21,7 +21,7 @@ <h2>Why is this an issue?</h2>
}
</pre>
<ul>
<li> Find a better data structure for the parameters that group data in a way that makes sense for the specific application domain </li>
<li>Find a better data structure for the parameters that group data in a way that makes sense for the specific application domain</li>
</ul>
<pre>
class Point // In geometry, Point is a logical structure to group data
Expand All @@ -39,12 +39,12 @@ <h2>Why is this an issue?</h2>
<h3>Exceptions</h3>
<p>Methods annotated with :</p>
<ul>
<li> Spring’s <code>@RequestMapping</code> (and related shortcut annotations, like <code>@GetRequest</code>) </li>
<li> JAX-RS API annotations (like <code>@javax.ws.rs.GET</code>) </li>
<li> Bean constructor injection with <code>@org.springframework.beans.factory.annotation.Autowired</code> </li>
<li> CDI constructor injection with <code>@javax.inject.Inject</code> </li>
<li> <code>@com.fasterxml.jackson.annotation.JsonCreator</code> </li>
<li> Micronaut’s annotations (like <code>@io.micronaut.http.annotation.Get</code>) </li>
<li>Spring’s <code>@RequestMapping</code> (and related shortcut annotations, like <code>@GetRequest</code>)</li>
<li>JAX-RS API annotations (like <code>@javax.ws.rs.GET</code>)</li>
<li>Bean constructor injection with <code>@org.springframework.beans.factory.annotation.Autowired</code></li>
<li>CDI constructor injection with <code>@javax.inject.Inject</code></li>
<li><code>@com.fasterxml.jackson.annotation.JsonCreator</code></li>
<li>Micronaut’s annotations (like <code>@io.micronaut.http.annotation.Get</code>)</li>
</ul>
<p>may have a lot of parameters, encapsulation being possible. Therefore the rule ignores such methods.</p>
<p>Also, if a class annotated as a Spring component (like <code>@org.springframework.stereotype.Component</code>) has a single constructor, that
Expand Down
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
<h2>Why is this an issue?</h2>
<p>Hard-coding a URI makes it difficult to test a program for a variety of reasons:</p>
<ul>
<li> path literals are not always portable across operating systems </li>
<li> a given absolute path may not exist in a specific test environment </li>
<li> a specified Internet URL may not be available when executing the tests </li>
<li> production environment filesystems usually differ from the development environment </li>
<li>path literals are not always portable across operating systems</li>
<li>a given absolute path may not exist in a specific test environment</li>
<li>a specified Internet URL may not be available when executing the tests</li>
<li>production environment filesystems usually differ from the development environment</li>
</ul>
<p>In addition, hard-coded URIs can contain sensitive information, like IP addresses, and they should not be stored in the code.</p>
<p>For all those reasons, a URI should never be hard coded. Instead, it should be replaced by a customizable parameter.</p>
Expand All @@ -13,9 +13,9 @@ <h2>Why is this an issue?</h2>
<h3>Exceptions</h3>
<p>This rule does not raise an issue when:</p>
<ul>
<li> A constant path is relative and contains at most two parts. </li>
<li> A constant path is used in an annotation </li>
<li> A path is annotated </li>
<li>A constant path is relative and contains at most two parts.</li>
<li>A constant path is used in an annotation</li>
<li>A path is annotated</li>
</ul>
<h2>How to fix it</h2>
<h3>Code examples</h3>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,25 +6,25 @@ <h2>Why is this an issue?</h2>
<p>This rule raises an issue when the inheritance tree, starting from <code>Object</code>, has a greater depth than is allowed.</p>
<p>The rule has one parameter to filter out classes of the count of inheritance. The following rules apply to define this parameter:</p>
<ul>
<li> <code>?</code> matches a single character </li>
<li> <code>*</code> matches zero or more characters </li>
<li> <code>**</code> matches zero or more packages </li>
<li><code>?</code> matches a single character</li>
<li><code>*</code> matches zero or more characters</li>
<li><code>**</code> matches zero or more packages</li>
</ul>
<p>Examples:</p>
<ul>
<li> <code>java.fwk.AbstractFwkClass</code>: the count stops when AbstractFwkClass class is reached. </li>
<li> <code>java.fwk.*</code>: any member of java.fwkPackage package is reached. </li>
<li> <code>java.fwk.**</code>: same as above, but including sub-packages. </li>
<li><code>java.fwk.AbstractFwkClass</code>: the count stops when AbstractFwkClass class is reached.</li>
<li><code>java.fwk.*</code>: any member of java.fwkPackage package is reached.</li>
<li><code>java.fwk.**</code>: same as above, but including sub-packages.</li>
</ul>
<h2>Exceptions:</h2>
<p>The rule stops counting when it encounters a class from one of the following packages (or sub-packages):</p>
<ul>
<li> <code>android.**</code> </li>
<li> <code>com.intellij.**</code> </li>
<li> <code>com.persistit.**</code> </li>
<li> <code>javax.swing.**</code> </li>
<li> <code>org.eclipse.**</code> </li>
<li> <code>org.springframework.**</code> </li>
<li><code>android.**</code></li>
<li><code>com.intellij.**</code></li>
<li><code>com.persistit.**</code></li>
<li><code>javax.swing.**</code></li>
<li><code>org.eclipse.**</code></li>
<li><code>org.springframework.**</code></li>
</ul>
<h2>Resources</h2>
<h3>Documentation</h3>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
<h2>Why is this an issue?</h2>
<p>Public fields in public classes do not respect the encapsulation principle and have three main disadvantages:</p>
<ul>
<li> Additional behavior such as validation cannot be added. </li>
<li> The internal representation is exposed, and cannot be changed afterwards. </li>
<li> Member values are subject to change from anywhere in the code and may not meet the programmer’s assumptions. </li>
<li>Additional behavior such as validation cannot be added.</li>
<li>The internal representation is exposed, and cannot be changed afterwards.</li>
<li>Member values are subject to change from anywhere in the code and may not meet the programmer’s assumptions.</li>
</ul>
<p>To prevent unauthorized modifications, private attributes and accessor methods (set and get) should be used.</p>
<h3>What is the potential impact?</h3>
Expand All @@ -17,14 +17,15 @@ <h3>Exceptions</h3>
<h2>How to fix it</h2>
<p>Depending on your need there are multiple options:</p>
<ul>
<li> Encapsulate the field
<li>Encapsulate the field
<ol>
<li> Make the field private. </li>
<li> Define methods to get and set the value of the field.<br> These methods are commonly known as getter and setter methods and are prefixed by
<code>get</code> and <code>set</code> followed by the name of the field. <em>Note:</em> as a bonus it is now possible to monitor value changes
using breakpoints. </li>
</ol> </li>
<li> Mark the field as <code>public final</code> if it is not supposed to change. </li>
<li>Make the field private.</li>
<li>Define methods to get and set the value of the field.
<br>
These methods are commonly known as getter and setter methods and are prefixed by <code>get</code> and <code>set</code> followed by the name
of the field. <em>Note:</em> as a bonus it is now possible to monitor value changes using breakpoints.</li>
</ol></li>
<li>Mark the field as <code>public final</code> if it is not supposed to change.</li>
</ul>
<h3>Code examples</h3>
<h4>Noncompliant code example</h4>
Expand Down Expand Up @@ -62,6 +63,6 @@ <h3>How does this work?</h3>
value.</p>
<h2>Resources</h2>
<ul>
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/493">CWE-493 - Critical Public Variable Without Final Modifier</a> </li>
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/493">CWE-493 - Critical Public Variable Without Final Modifier</a></li>
</ul>

Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ <h3>Noncompliant code example</h3>
</pre>
<h2>Resources</h2>
<ul>
<li> <a href="https://docs.oracle.com/javase/specs/jls/se17/html/jls-12.html#jls-12.6">docs.oracle.com</a> - Finalization of Class Instances </li>
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/586">CWE-586 - Explicit Call to Finalize()</a> </li>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/4jZGBQ">CERT, MET12-J.</a> - Do not use finalizers </li>
<li><a href="https://docs.oracle.com/javase/specs/jls/se17/html/jls-12.html#jls-12.6">docs.oracle.com</a> - Finalization of Class Instances</li>
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/586">CWE-586 - Explicit Call to Finalize()</a></li>
<li><a href="https://wiki.sei.cmu.edu/confluence/x/4jZGBQ">CERT, MET12-J.</a> - Do not use finalizers</li>
</ul>

Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,10 @@ <h2>Why is this an issue?</h2>
<h3>What is the potential impact?</h3>
<p>More unexpected issues can be caused by relying on the <code>finalize()</code> method to perform important operations on the application state:</p>
<ul>
<li> The JVM might terminate without ever calling this method on a particular object, leaving an unexpected or incomplete state of the program </li>
<li> Uncaught exceptions will be ignored inside this method, making it harder to detect issues that could have been logged otherwise </li>
<li> Finalizer methods can also be invoked concurrently, even on single-threaded applications, making it hard to maintain desired program invariants
</li>
<li>The JVM might terminate without ever calling this method on a particular object, leaving an unexpected or incomplete state of the program</li>
<li>Uncaught exceptions will be ignored inside this method, making it harder to detect issues that could have been logged otherwise</li>
<li>Finalizer methods can also be invoked concurrently, even on single-threaded applications, making it hard to maintain desired program
invariants</li>
</ul>
<h3>Noncompliant code example</h3>
<pre>
Expand All @@ -28,7 +28,7 @@ <h3>Exceptions</h3>
attack</em> as described in <em>MET12-J-EX1</em>.</p>
<h2>Resources</h2>
<ul>
<li> <a href="https://docs.oracle.com/javase/specs/jls/se17/html/jls-12.html#jls-12.6">docs.oracle.com</a> - Finalization of Class Instances </li>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/4jZGBQ">CERT, MET12-J.</a> - Do not use finalizers </li>
<li><a href="https://docs.oracle.com/javase/specs/jls/se17/html/jls-12.html#jls-12.6">docs.oracle.com</a> - Finalization of Class Instances</li>
<li><a href="https://wiki.sei.cmu.edu/confluence/x/4jZGBQ">CERT, MET12-J.</a> - Do not use finalizers</li>
</ul>

Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ <h3>Compliant solution</h3>
</pre>
<h2>Resources</h2>
<ul>
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/568">CWE-568 - finalize() Method Without super.finalize()</a> </li>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/4jZGBQ">CERT, MET12-J.</a> - Do not use finalizers </li>
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/568">CWE-568 - finalize() Method Without super.finalize()</a></li>
<li><a href="https://wiki.sei.cmu.edu/confluence/x/4jZGBQ">CERT, MET12-J.</a> - Do not use finalizers</li>
</ul>

Original file line number Diff line number Diff line change
Expand Up @@ -28,11 +28,10 @@ <h4>Compliant solution</h4>
<h2>Resources</h2>
<h3>Documentation</h3>
<ul>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/5dUxBQ">CERT, MSC12-C.</a> - Detect and remove code that has no effect or is never executed
</li>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/IDZGBQ">CERT, MSC51-J.</a> - Do not place a semicolon immediately following an if, for, or while
condition </li>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/WtYxBQ">CERT, EXP15-C.</a> - Do not place a semicolon on the same line as an if, for, or while
statement </li>
<li><a href="https://wiki.sei.cmu.edu/confluence/x/5dUxBQ">CERT, MSC12-C.</a> - Detect and remove code that has no effect or is never executed</li>
<li><a href="https://wiki.sei.cmu.edu/confluence/x/IDZGBQ">CERT, MSC51-J.</a> - Do not place a semicolon immediately following an if, for, or while
condition</li>
<li><a href="https://wiki.sei.cmu.edu/confluence/x/WtYxBQ">CERT, EXP15-C.</a> - Do not place a semicolon on the same line as an if, for, or while
statement</li>
</ul>

Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@ <h2>Why is this an issue?</h2>
<p>Shadowing occurs when a local variable has the same name as a variable or a field in an outer scope.</p>
<p>This can lead to three main problems:</p>
<ul>
<li> Confusion: The same name can refer to different variables in different parts of the scope, making the code hard to read and understand. </li>
<li> Unintended Behavior: You might accidentally use the wrong variable, leading to hard-to-detect bugs. </li>
<li> Maintenance Issues: If the inner variable is removed or renamed, the code’s behavior might change unexpectedly because the outer variable is
now being used. </li>
<li>Confusion: The same name can refer to different variables in different parts of the scope, making the code hard to read and understand.</li>
<li>Unintended Behavior: You might accidentally use the wrong variable, leading to hard-to-detect bugs.</li>
<li>Maintenance Issues: If the inner variable is removed or renamed, the code’s behavior might change unexpectedly because the outer variable is now
being used.</li>
</ul>
<p>To avoid these problems, rename the shadowing, shadowed, or both identifiers to accurately represent their purpose with unique and meaningful
names.</p>
Expand All @@ -24,13 +24,13 @@ <h3>Noncompliant code example</h3>
<h2>Resources</h2>
<h3>Documentation</h3>
<ul>
<li> CERT - <a href="https://wiki.sei.cmu.edu/confluence/display/java/DCL51-J.+Do+not+shadow+or+obscure+identifiers+in+subscopes">DCL51-J. Do not
shadow or obscure identifiers in subscopes</a> </li>
<li>CERT - <a href="https://wiki.sei.cmu.edu/confluence/display/java/DCL51-J.+Do+not+shadow+or+obscure+identifiers+in+subscopes">DCL51-J. Do not
shadow or obscure identifiers in subscopes</a></li>
</ul>
<h3>Related rules</h3>
<ul>
<li> {rule:java:S2176} - Class names should not shadow interfaces or superclasses </li>
<li> {rule:java:S2387} - Child class fields should not shadow parent class fields </li>
<li> {rule:java:S4977} - Type parameters should not shadow other type parameters </li>
<li>{rule:java:S2176} - Class names should not shadow interfaces or superclasses</li>
<li>{rule:java:S2387} - Child class fields should not shadow parent class fields</li>
<li>{rule:java:S4977} - Type parameters should not shadow other type parameters</li>
</ul>

Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,9 @@ <h3>Exceptions</h3>
<h2>How to fix it</h2>
<p>To fix this issue, make sure to throw specific exceptions that are relevant to the context in which they arise. It is recommended to either:</p>
<ul>
<li> Raise a specific exception from the Java standard library when one matches. For example an <code>IllegalArgumentException</code> should be
thrown when a method receives an invalid argument. </li>
<li> Create a custom exception class deriving from <code>Exception</code> or one of its subclasses. </li>
<li>Raise a specific exception from the Java standard library when one matches. For example an <code>IllegalArgumentException</code> should be
thrown when a method receives an invalid argument.</li>
<li>Create a custom exception class deriving from <code>Exception</code> or one of its subclasses.</li>
</ul>
<h3>Code examples</h3>
<h4>Noncompliant code example</h4>
Expand All @@ -53,11 +53,11 @@ <h4>Compliant solution</h4>
<h2>Resources</h2>
<h3>Standards</h3>
<ul>
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/397">CWE-397 Declaration of Throws for Generic Exception</a> </li>
<li> CERT - <a href="https://wiki.sei.cmu.edu/confluence/x/_DdGBQ">ERR07-J. Do not throw RuntimeException, Exception, or Throwable</a> </li>
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/397">CWE-397 Declaration of Throws for Generic Exception</a></li>
<li>CERT - <a href="https://wiki.sei.cmu.edu/confluence/x/_DdGBQ">ERR07-J. Do not throw RuntimeException, Exception, or Throwable</a></li>
</ul>
<h3>Related rules</h3>
<ul>
<li> {rule:java:S1181} - Generic exceptions should not be caught </li>
<li>{rule:java:S1181} - Generic exceptions should not be caught</li>
</ul>

Loading
Loading