Amazon QDetector Library Sign in to Amazon Q

Amazon Q

Detector Library

Java detectors (186/186)

Reflected cross site scripting Mandatory method not called after object creation Process empty record list in Amazon KCL Amazon STS regional instead of global endpoint AWS object presence check Poor error handling java rule Incorrect type conversion or cast Missing Authentication Missing timeout check on CountDownLatch.await Unspecified default value Device Permission Usage.Check eagle handler and authn handler ordering Deserialization of untrusted object Preserve thread interruption status rule Missing check on the value returned by moveToFirst API Missing timeout check on ExecutorService.awaitTermination Overflow when deserializing relational database objects Custom manual retries of AWS SDK calls Missing null check for cache response metadata Inefficient usage of Transaction library from AWS Labs Inefficient exception handling Insecure connection using unencrypted protocol Insecure Usage Of Cache Insecure Cryptographic Cipher Use of a deprecated method Error-prone AWS IAM policy creation Use of externally-controlled input to build connection string Inefficient Amazon S3 manual pagination Mutually exclusive call Bit shift checking AWS Lambda client not reused Missing check on the result of createNewFile Sensitive data stored unencrypted due to partial encryption Application logging of sensitive object data Missing AWS_SECURITY_TOKEN Missing statement to record cause of InvocationTargetException Misconfigured Concurrency Inefficient polling of AWS resource Improper Initialization Unexpected re-assignment of synchronized objects XPath injection Transitive auth rule AWS client not reused in a Lambda function Denial of service rule HTTP Connection Not Closed Long polling is not enabled in Amazon SQS XML Validation Insecure temporary file or directory Use of low-Level functionality HTTP response splitting Input and output values become out of sync Use String To Store Aws Account Id Server-side request forgery Missing Authorization for address id Do not catch and throw exception Concurrency deadlock Check mutable property in handler class Not recommended aws credentials classes Path traversal Override of reserved variable names in a Lambda function Missing byte array length of JSON parser Insecure Trust Manager Usage of an API that is not recommended Hardcoded credentials Weak Initialization Vector (IV)Insecure JSON web token (JWT) parsing Not calling finalize causes skipped cleanup steps Unchecked S3 object metadata content length Fortify Process Control Untrusted data in security decision Permissive cors configuration rule Insecure cookie Resource leak XML External Entity AWS client credentials AWS Region Handling in Java.Allow-listing pre-production service principals to production Wrapping Caught Invocation Target Exception Bad parameters used with AWS API methods Missing position check before getting substring LDAP injection Avoid reset exception in Amazon S3 Insecure hashing Backward compatibility breaks with error message parsing Inefficient map entry iteration Missing S3 bucket owner condition AWS DynamoDB getItem output is not null checked Invalid public method parameters Log injection Sensitive information leak Usage of multiple date time pattern formatter Zip Streaming Synchronous publication of AWS Lambda metrics XML External Entity Document Builder Factory Improper use of classes that aren't thread-safe Incorrect null check before setting a value Authorization Bypass Through User-Controlled Key Check uncaught exceptions Insufficient use of name in Amazon SQS queue Missing check on the value returned by ResultSet.next Insecure TLS version Unsanitized input is run as code Logging of sensitive information Use an enum to specify an AWS Region Improperly formatted string arguments Improper Neutralization of Input Used in a Command (Command Injection)throw inside finally Proper usage of Pattern matches.Untrusted AMI images Insecure SAML parser configuration Cross-site request forgery Case sensitive keys in S3 object user metadata Missing null check when retrieving the owner of an Amazon S3 object TLS certificate verification Stack trace not included in re-thrown exception Thread safety violation Region specification missing from AWS client initialization Insufficient number of PBEKeySpec iterations URL redirection to untrusted site Use of externally-controlled input to select classes or code Missing encryption of sensitive data in storage Ignored output of DynamoDBMapper operations Invoking String comparison method with null String Null pointer dereference Cross-site scripting Unauthenticated LDAP requests Use of inefficient APIs Low maintainability with old Android features Inefficient retrieval of first page of DynamoDB results Atomicity violation Missing handling of specifically-thrown exceptions Weak obfuscation of web request Dynamo mapper has items rule Varargs position error Clear text credentials Http handler ordering Session fixation Complicated DynamoDB query with expression attribute values Poor logging practice rule Syntax error in file Catching and not re-throwing or logging exceptions Missing check when launching an Android activity with an implicit intent Client constructor deprecation Inefficient use of stream sorting Incorrect File Permissions Arithmetic overflow or underflow Simplifiable code Loose file permissions Preferred DynamoDB GetKeys API not used Manual pagination Incorrect string equality operator Inefficient chain of AWS API calls OS command injection Internationalization Code clone SQL injection Missing check on method output Missing pagination Coral server side request forgery Untrusted data in http session Get records with limit rule Resources used by an Amazon S3 TransferManager are not released Insecure cryptography Missing timezone of SimpleDateFormat Hardcoded Active JDBC Credentials in Java Low maintainability with low class cohesion Json object refactoring rule Oversynchronization Missing release of resources rule Missing authorization Infinite loop Batch operations preferred over looping Inconsistent null check Application logging of sensitive data Object Input Stream Insecure Deserialization Weak pseudorandom number generation Insecure CORS policy Missing handling of file deletion result Amazon SQS message visibility changed without a status check State machine execution ARN is not logged Client-side KMS reencryption Unlogged exceptions in a stack trace Use Stream::anyMatch instead of Stream::findFirst or Stream::findAny Unterminated switch case blocks Batch request with unchecked failures Buffer underflow prevention

Tag: availability

Amazon STS regional instead of global endpoint

Use setRegion and setEndpoint methods to make calls to Regional Amazon STS endpoints.

Unspecified default value

Unspecified defaults can cause your application to crash.

Device Permission Usage.

Do not use API that requests system permission directly. Please onboard mShop Permission Service first.

Missing check on the value returned by moveToFirst API

Missing check on the value returned by moveToFirst API can cause your application to crash.

Overflow when deserializing relational database objects

Deserializing objects from relational databases should allocate a 64-bit, not 32-bit, type for the auto-incremented identifier.

Custom manual retries of AWS SDK calls

Custom manual retries of calls to AWS SDK APIs are inefficient.

Missing null check for cache response metadata

Accessing the cache response metadata without performing a null check might cause a null dereference error.

Use of a deprecated method

This code uses deprecated methods, which suggests that it has not been recently reviewed or maintained.

Bit shift checking

Rule to detect bit shifting.

AWS Lambda client not reused

Reuse AWS clients in Lambda.

AWS client not reused in a Lambda function

Recreating AWS clients in each Lambda function invocation is expensive.

Denial of service rule

A denial of service (DOS) attack can make a critical resource unavailable for legitimate users.

Insecure temporary file or directory

Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.

Concurrency deadlock

Improper use of locks in a multi-threaded program can lead to deadlock and cause the program to be unresponsive.

Override of reserved variable names in a Lambda function

Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.

Not calling finalize causes skipped cleanup steps

Always call super.finalize explicitly.

Unchecked S3 object metadata content length

Failure to specify a content length causes the contents of the input stream to buffer locally in memory in order to calculate its length. This can result in performance problems.

Resource leak

Allocated resources are not released properly.

Missing position check before getting substring

Getting a substring outside the range of a string can cause an index-out-of-bounds exception.

Invalid public method parameters

Public method parameters should be validated for nullness, unexpected values, and malicious values.

Improper use of classes that aren't thread-safe

Improper use of thread-unsafe classes in multi-threaded programs can cause the programs to be unstable.

Insufficient use of name in Amazon SQS queue

Provide the full URL for the Amazon SQS queue.

Missing check on the value returned by ResultSet.next

Missing check on the value returned by ResultSet.next can cause your application to crash.

Use an enum to specify an AWS Region

To minimize the risk of error, use an enum instead of a string to specify an AWS Region.

Missing null check when retrieving the owner of an Amazon S3 object

Missing null check when retrieving the owner of an Amazon S3 object can result in a null dereference error.

Thread safety violation

A thread safety violation might indicate a data race which can put the system into an inconsistent state.

Null pointer dereference

Dereferencing a null pointer can lead to unexpected null pointer exceptions.

Atomicity violation

Atomicity violations caused by improper usage of ConcurrentHashMap or ConcurrentLinkedQueue can result in crashses or incorrect program results.

Missing check when launching an Android activity with an implicit intent

Your application can crash if the check for an application that can receive the implicit intent is missing from code.

Infinite loop

Use loop control flow to ensure that loops are exited, even if exceptional behaviors are encountered.

Inconsistent null check

A missing null check might cause a null dereference error.

Missing handling of file deletion result

Unhandled failures of deleting files can exhaust file handles.

Buffer underflow prevention

An improper buffer read operation might lead to a BufferUnderflowException.