Security detectors
Rule to detect reflected XSS.
Unspecified defaults can cause your application to crash.
Do not use API that requests system permission directly. Please onboard mShop Permission Service first.
Deserialization of untrusted objects can lead to security vulnerabilities such as, inadvertently running remote code.
Missing check on the value returned by moveToFirst API can cause your application to crash.
Deserializing objects from relational databases should allocate a 64-bit, not 32-bit, type for the auto-incremented identifier.
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
Encryption can be improved by using Additional authenticated data (AAD).
Manually creating text-based IAM policies is error-prone.
Use of unsanitized user input to build connection strings can allow attackers to bypass security checks and access restricted resources.
Calls to mutually exclusive methods were found in the code.
Reuse AWS clients in Lambda.
Missing check on the result of createNewFile might cause data loss.
Encryption that is dependent on conditional logic, such as an if...then
clause, might cause unencrypted sensitive data to be stored.
The code failed to initialize or incorrectly initialized internal data, leading to undefined behavior.
Synchronized objects should not be re-assigned in the same synchronized
block because the references to the synchronized object would be lost.
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.
Recreating AWS clients in each Lambda function invocation is expensive.
Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.
Passing data from an untrusted source into a cookie or web response might expose the user to HTTP response splitting attacks.
If a method that uses an input parameter to update an output value throws an exception, then the output value is not updated.
Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.
Rule to detect lack of authorization check when using address ID.
Improper use of locks in a multi-threaded program can lead to deadlock and cause the program to be unresponsive.
Creating file paths from untrusted input might give a malicious actor access to sensitive files.
Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.
APIs that are not recommended were found.
Hardcoded credentials can be intercepted by malicious actors.
JWTs should not be parsed using the parse
method.
Always call super.finalize
explicitly.
Failure to specify a content length causes the contents of the input stream to buffer locally in memory in order to calculate its length. This can result in performance problems.
Security decisions should not depend on branching that can be influenced by untrusted or client-provided data.
Rule to enable detection for potential CORS vulnerabilities in services using the Coral or Spring frameworks.
Insecure cookies can lead to unencrypted transmission of sensitive data.
Allocated resources are not released properly.
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
An outdated or bad parameters were detected in calls to some AWS API methods.
LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.
Uploading objects to Amazon S3 by using streams (either through an AmazonS3 client or TransferManager
) might encounter network connectivity or timeout issues.
Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.
Not setting the S3 bucket owner condition might introduce a risk of accidentally using a wrong bucket.
Public method parameters should be validated for nullness, unexpected values, and malicious values.
Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.
Sensitive information should not be exposed through log files or stack traces.
Objects that parse or handle XML in XML document can lead to XML External Entity (XXE) attacks when misconfigured.
Missing check on the value returned by ResultSet.next can cause your application to crash.
TLS versions older than TLS version 1.1 support weak, broken, or misconfigured cryptography.
Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Improper filtering of Amazon Machine Images (AMIs) can result in loading an untrusted image, a potential security vulnerability.
Comment parsing for OpenSAML2 might enable an attacker to bypass authentication.
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
User metadata keys are case insensitive and are returned as lowercase strings, even if they were originally specified with uppercase strings.
When re-throwing an exception, make sure to include the stack trace.
Using less than 1,000 PBEKeySpec iterations is insecure.
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Use of unsanitized external input in reflection can allow attackers to bypass security checks and run malicious code.
Sensitive data is potentially persisted into storage or passed to another service without always being encrypted.
Check if errors are returned by DynamoDBMapper
's BatchWrite
operations.
Dereferencing a null pointer can lead to unexpected null pointer exceptions.
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Unauthenticated LDAP requests can allow untrusted access to LDAP servers.
Atomicity violations caused by improper usage of ConcurrentHashMap
or ConcurrentLinkedQueue
can result in crashses or incorrect program results.
Catching generic exceptions might hide issues when specific exceptions are thrown.
Weak obfuscation while configuring a web request
Credentials that are stored in clear text can be intercepted by a malicious actor.
Session fixation might allow an attacker to steal authenticated session IDs.
It's not good practice to catch an exception and then re-throw or log it.
Your application can crash if the check for an application that can receive the implicit intent is missing from code.
Use numeric types that are large enough to hold the result of arithmetic operations.
Weak file permissions can lead to privilege escalation.
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Use of untrusted inputs in SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Additional results are not checked for a paginated API call. This might produce inaccurate results.
Call ShutdownNow
when you use TransferManager
to manage transfers to Amazon S3.
Weak, broken, or misconfigured cryptography can lead to security vulnerabilities.
Using a SimpleDateFormat
object without setting its timezone can result in unexpected date and time.
Deserialization of untrusted data without sufficiently verifying that the resulting data will be valid.
Insufficiently random generators (or hardcoded seeds) can make pseudorandom sequences predictable.
Cross-Origin Resource Sharing policies that are too permissive may lead to security vulnerabilities.
Unhandled failures of deleting files can exhaust file handles.
Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.