Q
Detector Library
Java detectors (132/132)
Reflected cross site scriptingMandatory method not called after object creationProcess empty record list in Amazon KCLAWS object presence checkMissing timeout check on CountDownLatch.awaitUnspecified default valueDevice Permission Usage.Deserialization of untrusted objectPreserve thread interruption status ruleMissing check on the value returned by moveToFirst APIMissing timeout check on ExecutorService.awaitTerminationOverflow when deserializing relational database objectsCustom manual retries of AWS SDK callsMissing null check for cache response metadataInefficient usage of Transaction library from AWS LabsInsecure connection using unencrypted protocolInefficient additional authenticated data (AAD) authenticityUse of a deprecated methodError-prone AWS IAM policy creationUse of externally-controlled input to build connection stringInefficient Amazon S3 manual paginationMutually exclusive callAWS Lambda client not reusedMissing check on the result of createNewFileSensitive data stored unencrypted due to partial encryptionMissing statement to record cause of InvocationTargetExceptionMisconfigured ConcurrencyInefficient polling of AWS resourceImproper InitializationUnexpected re-assignment of synchronized objectsXPath injectionAWS client not reused in a Lambda functionLong polling is not enabled in Amazon SQSInsecure temporary file or directoryHTTP response splittingInput and output values become out of syncServer-side request forgeryMissing Authorization for address idDo not catch and throw exceptionConcurrency deadlockNot recommended aws credentials classesPath traversalOverride of reserved variable names in a Lambda functionMissing byte array length of JSON parserUsage of an API that is not recommendedHardcoded credentialsInsecure JSON web token (JWT) parsingNot calling finalize causes skipped cleanup stepsUnchecked S3 object metadata content lengthUntrusted data in security decisionPermissive cors configuration ruleInsecure cookieResource leakXML External EntityBad parameters used with AWS API methodsMissing position check before getting substringLDAP injectionAvoid reset exception in Amazon S3Insecure hashingBackward compatibility breaks with error message parsingInefficient map entry iterationMissing S3 bucket owner conditionAWS DynamoDB getItem output is not null checkedInvalid public method parametersLog injectionSensitive information leakUsage of multiple date time pattern formatterSynchronous publication of AWS Lambda metricsXML External Entity Document Builder FactoryImproper use of classes that aren't thread-safeIncorrect null check before setting a valueInsufficient use of name in Amazon SQS queueMissing check on the value returned by ResultSet.nextInsecure TLS versionUnsanitized input is run as codeUse an enum to specify an AWS RegionImproperly formatted string argumentsImproper service shutdownUnrestricted upload of dangerous file typeUntrusted AMI imagesInsecure SAML parser configurationCross-site request forgeryCase sensitive keys in S3 object user metadataStack trace not included in re-thrown exceptionRegion specification missing from AWS client initializationInsufficient number of PBEKeySpec iterationsURL redirection to untrusted siteUse of externally-controlled input to select classes or codeMissing encryption of sensitive data in storageIgnored output of DynamoDBMapper operationsNull pointer dereferenceCross-site scriptingUnauthenticated LDAP requestsUse of inefficient APIsLow maintainability with old Android featuresAtomicity violationMissing handling of specifically-thrown exceptionsWeak obfuscation of web requestClear text credentialsSession fixationCatching and not re-throwing or logging exceptionsMissing check when launching an Android activity with an implicit intentClient constructor deprecationInefficient use of stream sortingArithmetic overflow or underflowSimplifiable codeLoose file permissionsManual paginationIncorrect string equality operatorInefficient chain of AWS API callsOS command injectionInternationalizationCode cloneSQL injectionMissing check on method outputMissing paginationResources used by an Amazon S3 TransferManager are not releasedInsecure cryptographyMissing timezone of SimpleDateFormatLow maintainability with low class cohesionOversynchronizationInfinite loopBatch operations preferred over loopingObject Input Stream Insecure DeserializationWeak pseudorandom number generationInsecure CORS policyMissing handling of file deletion resultAmazon SQS message visibility changed without a status checkState machine execution ARN is not loggedClient-side KMS reencryptionUse Stream::anyMatch instead of Stream::findFirst or Stream::findAnyBatch request with unchecked failures
Tag: owasp-top10
Reflected cross site scripting
Rule to detect reflected XSS.
Deserialization of untrusted object
Deserialization of untrusted objects can lead to security vulnerabilities such as, inadvertently running remote code.
Insecure connection using unencrypted protocol
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
Error-prone AWS IAM policy creation
Manually creating text-based IAM policies is error-prone.
Sensitive data stored unencrypted due to partial encryption
Encryption that is dependent on conditional logic, such as an
if...then clause, might cause unencrypted sensitive data to be stored.XPath injection
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.
Insecure temporary file or directory
Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.
HTTP response splitting
Passing data from an untrusted source into a cookie or web response might expose the user to HTTP response splitting attacks.
Server-side request forgery
Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.
Missing Authorization for address id
Rule to detect lack of authorization check when using address ID.
Not recommended aws credentials classes
Find usages of not recommended classes for AWS Credentials and suggest replacing them with something else.
Path traversal
Creating file paths from untrusted input might give a malicious actor access to sensitive files.
Hardcoded credentials
Hardcoded credentials can be intercepted by malicious actors.
Insecure JSON web token (JWT) parsing
JWTs should not be parsed using the
parse method.Untrusted data in security decision
Security decisions should not depend on branching that can be influenced by untrusted or client-provided data.
Permissive cors configuration rule
Rule to enable detection for potential CORS vulnerabilities in services using the Coral or Spring frameworks.
Insecure cookie
Insecure cookies can lead to unencrypted transmission of sensitive data.
XML External Entity
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
LDAP injection
LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.
Insecure hashing
Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.
Invalid public method parameters
Public method parameters should be validated for nullness, unexpected values, and malicious values.
Log injection
Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.
Sensitive information leak
Sensitive information should not be exposed through log files or stack traces.
XML External Entity Document Builder Factory
Objects that parse or handle XML in XML document can lead to XML External Entity (XXE) attacks when misconfigured.
Insecure TLS version
TLS versions older than TLS version 1.1 support weak, broken, or misconfigured cryptography.
Unsanitized input is run as code
Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.
Unrestricted upload of dangerous file type
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Insecure SAML parser configuration
Comment parsing for OpenSAML2 might enable an attacker to bypass authentication.
Cross-site request forgery
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
URL redirection to untrusted site
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Use of externally-controlled input to select classes or code
Use of unsanitized external input in reflection can allow attackers to bypass security checks and run malicious code.
Cross-site scripting
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Unauthenticated LDAP requests
Unauthenticated LDAP requests can allow untrusted access to LDAP servers.
Weak obfuscation of web request
Weak obfuscation while configuring a web request
Clear text credentials
Credentials that are stored in clear text can be intercepted by a malicious actor.
Session fixation
Session fixation might allow an attacker to steal authenticated session IDs.
Loose file permissions
Weak file permissions can lead to privilege escalation.
OS command injection
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
SQL injection
Use of untrusted inputs in SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Insecure cryptography
Weak, broken, or misconfigured cryptography can lead to security vulnerabilities.
Object Input Stream Insecure Deserialization
Deserialization of untrusted data without sufficiently verifying that the resulting data will be valid.
Weak pseudorandom number generation
Insufficiently random generators (or hardcoded seeds) can make pseudorandom sequences predictable.
Insecure CORS policy
Cross-Origin Resource Sharing policies that are too permissive may lead to security vulnerabilities.
Client-side KMS reencryption
Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.