Amazon Q
Detector Library
Java detectors (186/186)
Reflected cross site scriptingMandatory method not called after object creationProcess empty record list in Amazon KCLAmazon STS regional instead of global endpointAWS object presence checkPoor error handling java ruleIncorrect type conversion or castMissing AuthenticationMissing timeout check on CountDownLatch.awaitUnspecified default valueDevice Permission Usage.Check eagle handler and authn handler orderingDeserialization of untrusted objectPreserve thread interruption status ruleMissing check on the value returned by moveToFirst APIMissing timeout check on ExecutorService.awaitTerminationOverflow when deserializing relational database objectsCustom manual retries of AWS SDK callsMissing null check for cache response metadataInefficient usage of Transaction library from AWS LabsInefficient exception handlingInsecure connection using unencrypted protocolInsecure Usage Of CacheInsecure Cryptographic CipherUse of a deprecated methodError-prone AWS IAM policy creationUse of externally-controlled input to build connection stringInefficient Amazon S3 manual paginationMutually exclusive callBit shift checkingAWS Lambda client not reusedMissing check on the result of createNewFileSensitive data stored unencrypted due to partial encryptionApplication logging of sensitive object dataMissing AWS_SECURITY_TOKENMissing statement to record cause of InvocationTargetExceptionMisconfigured ConcurrencyInefficient polling of AWS resourceImproper InitializationUnexpected re-assignment of synchronized objectsXPath injectionTransitive auth ruleAWS client not reused in a Lambda functionDenial of service ruleHTTP Connection Not ClosedLong polling is not enabled in Amazon SQSXML ValidationInsecure temporary file or directoryUse of low-Level functionalityHTTP response splittingInput and output values become out of syncUse String To Store Aws Account IdServer-side request forgeryMissing Authorization for address idDo not catch and throw exceptionConcurrency deadlockCheck mutable property in handler classNot recommended aws credentials classesPath traversalOverride of reserved variable names in a Lambda functionMissing byte array length of JSON parserInsecure Trust ManagerUsage of an API that is not recommendedHardcoded credentialsWeak Initialization Vector (IV)Insecure JSON web token (JWT) parsingNot calling finalize causes skipped cleanup stepsUnchecked S3 object metadata content lengthFortify Process ControlUntrusted data in security decisionPermissive cors configuration ruleInsecure cookieResource leakXML External EntityAWS client credentialsAWS Region Handling in Java.Allow-listing pre-production service principals to productionWrapping Caught Invocation Target ExceptionBad parameters used with AWS API methodsMissing position check before getting substringLDAP injectionAvoid reset exception in Amazon S3Insecure hashingBackward compatibility breaks with error message parsingInefficient map entry iterationMissing S3 bucket owner conditionAWS DynamoDB getItem output is not null checkedInvalid public method parametersLog injectionSensitive information leakUsage of multiple date time pattern formatterZip StreamingSynchronous publication of AWS Lambda metricsXML External Entity Document Builder FactoryImproper use of classes that aren't thread-safeIncorrect null check before setting a valueAuthorization Bypass Through User-Controlled KeyCheck uncaught exceptionsInsufficient use of name in Amazon SQS queueMissing check on the value returned by ResultSet.nextInsecure TLS versionUnsanitized input is run as codeLogging of sensitive informationUse an enum to specify an AWS RegionImproperly formatted string argumentsImproper Neutralization of Input Used in a Command (Command Injection)throw inside finallyProper usage of Pattern matches.Untrusted AMI imagesInsecure SAML parser configurationCross-site request forgeryCase sensitive keys in S3 object user metadataMissing null check when retrieving the owner of an Amazon S3 objectTLS certificate verificationStack trace not included in re-thrown exceptionThread safety violationRegion specification missing from AWS client initializationInsufficient number of PBEKeySpec iterationsURL redirection to untrusted siteUse of externally-controlled input to select classes or codeMissing encryption of sensitive data in storageIgnored output of DynamoDBMapper operationsInvoking String comparison method with null StringNull pointer dereferenceCross-site scriptingUnauthenticated LDAP requestsUse of inefficient APIsLow maintainability with old Android featuresInefficient retrieval of first page of DynamoDB resultsAtomicity violationMissing handling of specifically-thrown exceptionsWeak obfuscation of web requestDynamo mapper has items ruleVarargs position errorClear text credentialsHttp handler orderingSession fixationComplicated DynamoDB query with expression attribute valuesPoor logging practice ruleSyntax error in fileCatching and not re-throwing or logging exceptionsMissing check when launching an Android activity with an implicit intentClient constructor deprecationInefficient use of stream sortingIncorrect File PermissionsArithmetic overflow or underflowSimplifiable codeLoose file permissionsPreferred DynamoDB GetKeys API not usedManual paginationIncorrect string equality operatorInefficient chain of AWS API callsOS command injectionInternationalizationCode cloneSQL injectionMissing check on method outputMissing paginationCoral server side request forgeryUntrusted data in http sessionGet records with limit ruleResources used by an Amazon S3 TransferManager are not releasedInsecure cryptographyMissing timezone of SimpleDateFormatHardcoded Active JDBC Credentials in JavaLow maintainability with low class cohesionJson object refactoring ruleOversynchronizationMissing release of resources ruleMissing authorizationInfinite loopBatch operations preferred over loopingInconsistent null checkApplication logging of sensitive dataObject Input Stream Insecure DeserializationWeak pseudorandom number generationInsecure CORS policyMissing handling of file deletion resultAmazon SQS message visibility changed without a status checkState machine execution ARN is not loggedClient-side KMS reencryptionUnlogged exceptions in a stack traceUse Stream::anyMatch instead of Stream::findFirst or Stream::findAnyUnterminated switch case blocksBatch request with unchecked failuresBuffer underflow prevention
Code Quality detectors
Mandatory method not called after object creation
Mandatory methods must be called after object creation.
Process empty record list in Amazon KCL
Setting
withCallProcessRecordsEvenForEmptyRecordList to TRUE during Kinesis Client Library (KCL) initialization will treat empty records differently.Amazon STS regional instead of global endpoint
Use
setRegion and setEndpoint methods to make calls to Regional Amazon STS endpoints.AWS object presence check
Manually performing an object existence check is inefficient when a built-in operation is available.
Poor error handling java rule
Checks if the catch block handles a broad swath of exceptions.
Missing timeout check on CountDownLatch.await
Missing timeout check on CountDownLatch.await can cause synchronization errors.
Preserve thread interruption status rule
Preserve Thread Interruption Status Rule.
Missing timeout check on ExecutorService.awaitTermination
Missing timeout checks on awaitTermination might make the code harder to debug.
Custom manual retries of AWS SDK calls
Custom manual retries of calls to AWS SDK APIs are inefficient.
Missing null check for cache response metadata
Accessing the cache response metadata without performing a
null check might cause a null dereference error.Inefficient usage of Transaction library from AWS Labs
The AWS Labs Transactions Library is a client-side solution and less efficient compared to DynamoDB native transactions.
Inefficient exception handling
Throwing too many exceptions can cause performance issues.
Use of a deprecated method
This code uses deprecated methods, which suggests that it has not been recently reviewed or maintained.
Inefficient Amazon S3 manual pagination
Use
S3Objects.withPrefix() instead of manually paginating results.Bit shift checking
Rule to detect bit shifting.
Missing statement to record cause of InvocationTargetException
Missing statements to record the underlying cause of InvocationTargetException.
Misconfigured Concurrency
Misconfigured CompletableFuture.get or Future.get.
Inefficient polling of AWS resource
Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.
HTTP Connection Not Closed
Neglecting to close opened resources in the finally block in Java violates resource management principles, risking resource leaks and performance issues.
Long polling is not enabled in Amazon SQS
Enable long polling for efficiency.
XML Validation
Objects that parse or handle XML in XML document can lead to XML External Entity (XXE) attacks when misconfigured.
Use String To Store Aws Account Id
When using AWS AccountId it is advisable to use String datatype instead of numeric types to avoid leading zero truncation.
Do not catch and throw exception
Do not catch and throw the same exception.
Not recommended aws credentials classes
Find usages of not recommended classes for AWS Credentials and suggest replacing them with something else.
Missing byte array length of JSON parser
Specify the length of the input byte array when creating a
JSON parser to avoid a deserialization problem.AWS Region Handling in Java.
Prefer RegionUtils over Regions and S3Regions enums for easy support of new AWS regions.
Wrapping Caught Invocation Target Exception
Recommends type-casting the exception into unchecked exception and throwing it.
Missing position check before getting substring
Getting a substring outside the range of a string can cause an index-out-of-bounds exception.
Backward compatibility breaks with error message parsing
Maintain your code's backward compatibility by checking the status code instead of parsing the error message.
Inefficient map entry iteration
Iterating on
Map entries is more efficient than iterating on the keys and asking for their respective values.AWS DynamoDB getItem output is not null checked
Outputs of AWS DynamoDB's
GetItem method are not null checked.Usage of multiple date time pattern formatter
Detects the usage of multiple date time pattern.
Synchronous publication of AWS Lambda metrics
Synchronous publication of AWS Lambda metrics is inefficient.
Improper use of classes that aren't thread-safe
Improper use of thread-unsafe classes in multi-threaded programs can cause the programs to be unstable.
Incorrect null check before setting a value
When a variable is assigned a value after checking if it's not
null (for example, x != null insead of x == null), it might be inadvertently overwritten.Check uncaught exceptions
Check and suggest to catch all uncaught AWS API exceptions.
Insufficient use of name in Amazon SQS queue
Provide the full URL for the Amazon SQS queue.
Use an enum to specify an AWS Region
To minimize the risk of error, use an enum instead of a string to specify an AWS Region.
Improperly formatted string arguments
Format strings appropriately for their argument types. For example, use
%d, not %s, for integers.throw inside finally
Writing throw keyword in finally block disrupts logical execution of code, instead write it under catch block.
Proper usage of Pattern matches.
Compile regex pattern only once and reuse for all iterations when processing loops or streams.
Missing null check when retrieving the owner of an Amazon S3 object
Missing
null check when retrieving the owner of an Amazon S3 object can result in a null dereference error.Region specification missing from AWS client initialization
Set an explicit AWS Region to avoid cold start delays in AWS client initialization.
Invoking String comparison method with null String
Invoking String comparison method with null String can lead to NullPointerException.
Use of inefficient APIs
Performance of this code can be enhanced by using alternative APIs.
Low maintainability with old Android features
Code uses older Android features.
Inefficient retrieval of first page of DynamoDB results
Using
queryPage followed by getResults to retrieve a single page of results is inefficient.Dynamo mapper has items rule
The API
hasItems returns true if the service returned a value for the Items property.Varargs position error
A
Varargs position error was detectedComplicated DynamoDB query with expression attribute values
Use
withHashKeyValues to set one or more hash key values of a DynamoDB querySyntax error in file
Some files contain syntax errors.
Client constructor deprecation
Client constructors are now deprecated in favor of using builders to create the client.
Inefficient use of stream sorting
Using
Stream::min or Stream::max is more efficient than sorting and getting the first element in a stream.Simplifiable code
Simplifiable code might be harder to read or maintain.
Preferred DynamoDB GetKeys API not used
use
GetKeys API of DynamodbStreamRecord directlyManual pagination
Suggest using auto-pagination instead of manual pagination.
Incorrect string equality operator
Use
equals(), not ==, when checking if two strings are equal.Inefficient chain of AWS API calls
The chain of API calls can be replaced with a single, more efficient API call.
Internationalization
Improper use of locals prevent internationalization.
Code clone
Similar code fragments were detected in the same file.
Missing check on method output
Missing checks might cause silent failures that are harder to debug.
Get records with limit rule
The API
GetRecordsRequest.withLimit(limit) returns the number of records that is specified by the limit parameter.Low maintainability with low class cohesion
Classes with low class cohesion contain unrelated operations which make them difficult to understand and less likely to be used.
Json object refactoring rule
Json object refactoring rule.
Oversynchronization
Oversynchronization with
ConcurrentHashMap or ConcurrentLinkedQueue can reduce program performance.Infinite loop
Use loop control flow to ensure that loops are exited, even if exceptional behaviors are encountered.
Batch operations preferred over looping
Batch operations are more efficient than looping to process several items at the same time.
Inconsistent null check
A missing null check might cause a null dereference error.
Amazon SQS message visibility changed without a status check
When you change Amazon SQS message visibility, check for
MessageNotInFlight exceptions.State machine execution ARN is not logged
Log the ARN identifying the state machine execution for better debuggability.
Use Stream::anyMatch instead of Stream::findFirst or Stream::findAny
Using
Stream::anyMatch is more readable and convenient than using a chain of Stream::filter, Stream::findFirst or Stream::findAny and Optional::isPresent.Unterminated switch case blocks
Terminate
case statements in a switch block properly.Batch request with unchecked failures
Not checking which items have failed can lead to loss of data.
Buffer underflow prevention
An improper buffer read operation might lead to a
BufferUnderflowException.