AWS logo
Amazon QDetector Library

Security detectors

Reflected cross site scripting

Rule to detect reflected XSS.

Incorrect type conversion or cast

The software does not correctly convert an object, resource, or structure from one type to a different type.

Missing Authentication

Missing authentication checks can lead to unauthorized access to a resource or performance of an action.

Unspecified default value

Unspecified defaults can cause your application to crash.

Device Permission Usage.

Do not use API that requests system permission directly. Please onboard mShop Permission Service first.

Check eagle handler and authn handler ordering

EagleHandler must appear after AuthNHandler to make sure that all authenticated calls are correctly logged.

Deserialization of untrusted object

Deserialization of untrusted objects can lead to security vulnerabilities such as, inadvertently running remote code.

Missing check on the value returned by moveToFirst API

Missing check on the value returned by moveToFirst API can cause your application to crash.

Overflow when deserializing relational database objects

Deserializing objects from relational databases should allocate a 64-bit, not 32-bit, type for the auto-incremented identifier.

Insecure connection using unencrypted protocol

Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.

Insecure Usage Of Cache

Passing StringByteConverter to Cache could cause buffer access length errors.

Insecure Cryptographic Cipher

Insecure Cryptographic Cipher

Error-prone AWS IAM policy creation

Manually creating text-based IAM policies is error-prone.

Use of externally-controlled input to build connection string

Use of unsanitized user input to build connection strings can allow attackers to bypass security checks and access restricted resources.

Mutually exclusive call

Calls to mutually exclusive methods were found in the code.

AWS Lambda client not reused

Reuse AWS clients in Lambda.

Missing check on the result of createNewFile

Missing check on the result of createNewFile might cause data loss.

Sensitive data stored unencrypted due to partial encryption

Encryption that is dependent on conditional logic, such as an if...then clause, might cause unencrypted sensitive data to be stored.

Application logging of sensitive object data

Application logging of sensitive object data

Missing AWS_SECURITY_TOKEN

Set the AWS_SECURITY_TOKEN attribute for IAM with temporary credentials.

Improper Initialization

The code failed to initialize or incorrectly initialized internal data, leading to undefined behavior.

Unexpected re-assignment of synchronized objects

Synchronized objects should not be re-assigned in the same synchronized block because the references to the synchronized object would be lost.

XPath injection

Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.

Transitive auth rule

Rule for detecting lack of transitive auth.

AWS client not reused in a Lambda function

Recreating AWS clients in each Lambda function invocation is expensive.

Denial of service rule

A denial of service (DOS) attack can make a critical resource unavailable for legitimate users.

Insecure temporary file or directory

Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.

Use of low-Level functionality

Use of low level functionality in application development which is prohibited by the framework or specification under which the application is supposed to operate.

HTTP response splitting

Passing data from an untrusted source into a cookie or web response might expose the user to HTTP response splitting attacks.

Input and output values become out of sync

If a method that uses an input parameter to update an output value throws an exception, then the output value is not updated.

Server-side request forgery

Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.

Missing Authorization for address id

Rule to detect lack of authorization check when using address ID.

Concurrency deadlock

Improper use of locks in a multi-threaded program can lead to deadlock and cause the program to be unresponsive.

Check mutable property in handler class

Rule to detect any Handler class with a mutable property that can be accessed via the Job object passed to the before/after method.

Path traversal

Creating file paths from untrusted input might give a malicious actor access to sensitive files.

Override of reserved variable names in a Lambda function

Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.

Insecure Trust Manager

Insecure Trust Manager can allow connection to a host that is not signed by a trusted authority.

Usage of an API that is not recommended

APIs that are not recommended were found.

Hardcoded credentials

Hardcoded credentials can be intercepted by malicious actors.

Weak Initialization Vector (IV)

Using a static or predictable initialization vector (IV) for a cryptographic cipher is security sensitive.

Insecure JSON web token (JWT) parsing

JWTs should not be parsed using the parse method.

Not calling finalize causes skipped cleanup steps

Always call super.finalize explicitly.

Unchecked S3 object metadata content length

Failure to specify a content length causes the contents of the input stream to buffer locally in memory in order to calculate its length. This can result in performance problems.

Fortify Process Control

Checks whether System.loadLibrary is used.

Untrusted data in security decision

Security decisions should not depend on branching that can be influenced by untrusted or client-provided data.

Permissive cors configuration rule

Rule to enable detection for potential CORS vulnerabilities in services using the Coral or Spring frameworks.

Insecure cookie

Insecure cookies can lead to unencrypted transmission of sensitive data.

Resource leak

Allocated resources are not released properly.

XML External Entity

Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.

AWS client credentials

Pass Credentials provider instead of credential to account for automatic credential rotation.

Allow-listing pre-production service principals to production

Allow-listing pre-production service principals to production

Bad parameters used with AWS API methods

An outdated or bad parameters were detected in calls to some AWS API methods.

LDAP injection

LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.

Avoid reset exception in Amazon S3

Uploading objects to Amazon S3 by using streams (either through an AmazonS3 client or TransferManager) might encounter network connectivity or timeout issues.

Insecure hashing

Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.

Missing S3 bucket owner condition

Not setting the S3 bucket owner condition might introduce a risk of accidentally using a wrong bucket.

Invalid public method parameters

Public method parameters should be validated for nullness, unexpected values, and malicious values.

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Sensitive information leak

Sensitive information should not be exposed through log files or stack traces.

Zip Streaming

Parsing ZIP files using streaming.

XML External Entity Document Builder Factory

Objects that parse or handle XML in XML document can lead to XML External Entity (XXE) attacks when misconfigured.

Authorization Bypass Through User-Controlled Key

The system's authorization does not prevent a user from accessing another user's data by modifying key values.

Missing check on the value returned by ResultSet.next

Missing check on the value returned by ResultSet.next can cause your application to crash.

Insecure TLS version

TLS versions older than TLS version 1.1 support weak, broken, or misconfigured cryptography.

Unsanitized input is run as code

Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.

Logging of sensitive information

The logging of sensitive information can expose the information to potential attackers.

Improper Neutralization of Input Used in a Command (Command Injection)

Improper Neutralization of Input Used in a Command (Command Injection)

Untrusted AMI images

Improper filtering of Amazon Machine Images (AMIs) can result in loading an untrusted image, a potential security vulnerability.

Insecure SAML parser configuration

Comment parsing for OpenSAML2 might enable an attacker to bypass authentication.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CSRF) vulnerability.

Case sensitive keys in S3 object user metadata

User metadata keys are case insensitive and are returned as lowercase strings, even if they were originally specified with uppercase strings.

TLS certificate verification

The application does not verify server certification for TLS connection.

Stack trace not included in re-thrown exception

When re-throwing an exception, make sure to include the stack trace.

Thread safety violation

A thread safety violation might indicate a data race which can put the system into an inconsistent state.

Insufficient number of PBEKeySpec iterations

Using less than 1,000 PBEKeySpec iterations is insecure.

URL redirection to untrusted site

User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.

Use of externally-controlled input to select classes or code

Use of unsanitized external input in reflection can allow attackers to bypass security checks and run malicious code.

Missing encryption of sensitive data in storage

Sensitive data is potentially persisted into storage or passed to another service without always being encrypted.

Ignored output of DynamoDBMapper operations

Check if errors are returned by DynamoDBMapper's BatchWrite operations.

Null pointer dereference

Dereferencing a null pointer can lead to unexpected null pointer exceptions.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Unauthenticated LDAP requests

Unauthenticated LDAP requests can allow untrusted access to LDAP servers.

Atomicity violation

Atomicity violations caused by improper usage of ConcurrentHashMap or ConcurrentLinkedQueue can result in crashses or incorrect program results.

Missing handling of specifically-thrown exceptions

Catching generic exceptions might hide issues when specific exceptions are thrown.

Weak obfuscation of web request

Weak obfuscation while configuring a web request

Clear text credentials

Credentials that are stored in clear text can be intercepted by a malicious actor.

Http handler ordering

JsonHttpBindingHandler should occur in your code before the HttpRpcHandler.

Session fixation

Session fixation might allow an attacker to steal authenticated session IDs.

Poor logging practice rule

Using println() rather than a dedicated logging facility makes it difficult to monitor the program behavior.

Catching and not re-throwing or logging exceptions

It's not good practice to catch an exception and then re-throw or log it.

Missing check when launching an Android activity with an implicit intent

Your application can crash if the check for an application that can receive the implicit intent is missing from code.

Incorrect File Permissions

Improperly set permissions can lead to excessive access or restricted functionality, posing security risks.

Arithmetic overflow or underflow

Use numeric types that are large enough to hold the result of arithmetic operations.

Loose file permissions

Weak file permissions can lead to privilege escalation.

OS command injection

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

SQL injection

Use of untrusted inputs in SQL database query can enable attackers to read, modify, or delete sensitive data in the database

Missing pagination

Additional results are not checked for a paginated API call. This might produce inaccurate results.

Coral server side request forgery

Checks if data from request object is passed to new server-side requests without validation in a Coral service.

Untrusted data in http session

User input in setAttribute could lead to trust boundary violation.

Resources used by an Amazon S3 TransferManager are not released

Call ShutdownNow when you use TransferManager to manage transfers to Amazon S3.

Insecure cryptography

Weak, broken, or misconfigured cryptography can lead to security vulnerabilities.

Missing timezone of SimpleDateFormat

Using a SimpleDateFormat object without setting its timezone can result in unexpected date and time.

Hardcoded Active JDBC Credentials in Java

Hardcoded Active JDBC Credentials in Java

Missing release of resources rule

Resources requiring explicit closure must be properly released to prevent leaks

Missing authorization

Missing authorization checks can lead to unauthorized access to a resource or performance of an action.

Application logging of sensitive data

Application logging of sensitive data

Object Input Stream Insecure Deserialization

Deserialization of untrusted data without sufficiently verifying that the resulting data will be valid.

Weak pseudorandom number generation

Insufficiently random generators (or hardcoded seeds) can make pseudorandom sequences predictable.

Insecure CORS policy

Cross-Origin Resource Sharing policies that are too permissive may lead to security vulnerabilities.

Missing handling of file deletion result

Unhandled failures of deleting files can exhaust file handles.

Client-side KMS reencryption

Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.

Unlogged exceptions in a stack trace

When logging an exception, make sure to include the stack trace.