Amazon Q
Detector Library
Java detectors (186/186)
Reflected cross site scriptingMandatory method not called after object creationProcess empty record list in Amazon KCLAmazon STS regional instead of global endpointAWS object presence checkPoor error handling java ruleIncorrect type conversion or castMissing AuthenticationMissing timeout check on CountDownLatch.awaitUnspecified default valueDevice Permission Usage.Check eagle handler and authn handler orderingDeserialization of untrusted objectPreserve thread interruption status ruleMissing check on the value returned by moveToFirst APIMissing timeout check on ExecutorService.awaitTerminationOverflow when deserializing relational database objectsCustom manual retries of AWS SDK callsMissing null check for cache response metadataInefficient usage of Transaction library from AWS LabsInefficient exception handlingInsecure connection using unencrypted protocolInsecure Usage Of CacheInsecure Cryptographic CipherUse of a deprecated methodError-prone AWS IAM policy creationUse of externally-controlled input to build connection stringInefficient Amazon S3 manual paginationMutually exclusive callBit shift checkingAWS Lambda client not reusedMissing check on the result of createNewFileSensitive data stored unencrypted due to partial encryptionApplication logging of sensitive object dataMissing AWS_SECURITY_TOKENMissing statement to record cause of InvocationTargetExceptionMisconfigured ConcurrencyInefficient polling of AWS resourceImproper InitializationUnexpected re-assignment of synchronized objectsXPath injectionTransitive auth ruleAWS client not reused in a Lambda functionDenial of service ruleHTTP Connection Not ClosedLong polling is not enabled in Amazon SQSXML ValidationInsecure temporary file or directoryUse of low-Level functionalityHTTP response splittingInput and output values become out of syncUse String To Store Aws Account IdServer-side request forgeryMissing Authorization for address idDo not catch and throw exceptionConcurrency deadlockCheck mutable property in handler classNot recommended aws credentials classesPath traversalOverride of reserved variable names in a Lambda functionMissing byte array length of JSON parserInsecure Trust ManagerUsage of an API that is not recommendedHardcoded credentialsWeak Initialization Vector (IV)Insecure JSON web token (JWT) parsingNot calling finalize causes skipped cleanup stepsUnchecked S3 object metadata content lengthFortify Process ControlUntrusted data in security decisionPermissive cors configuration ruleInsecure cookieResource leakXML External EntityAWS client credentialsAWS Region Handling in Java.Allow-listing pre-production service principals to productionWrapping Caught Invocation Target ExceptionBad parameters used with AWS API methodsMissing position check before getting substringLDAP injectionAvoid reset exception in Amazon S3Insecure hashingBackward compatibility breaks with error message parsingInefficient map entry iterationMissing S3 bucket owner conditionAWS DynamoDB getItem output is not null checkedInvalid public method parametersLog injectionSensitive information leakUsage of multiple date time pattern formatterZip StreamingSynchronous publication of AWS Lambda metricsXML External Entity Document Builder FactoryImproper use of classes that aren't thread-safeIncorrect null check before setting a valueAuthorization Bypass Through User-Controlled KeyCheck uncaught exceptionsInsufficient use of name in Amazon SQS queueMissing check on the value returned by ResultSet.nextInsecure TLS versionUnsanitized input is run as codeLogging of sensitive informationUse an enum to specify an AWS RegionImproperly formatted string argumentsImproper Neutralization of Input Used in a Command (Command Injection)throw inside finallyProper usage of Pattern matches.Untrusted AMI imagesInsecure SAML parser configurationCross-site request forgeryCase sensitive keys in S3 object user metadataMissing null check when retrieving the owner of an Amazon S3 objectTLS certificate verificationStack trace not included in re-thrown exceptionThread safety violationRegion specification missing from AWS client initializationInsufficient number of PBEKeySpec iterationsURL redirection to untrusted siteUse of externally-controlled input to select classes or codeMissing encryption of sensitive data in storageIgnored output of DynamoDBMapper operationsInvoking String comparison method with null StringNull pointer dereferenceCross-site scriptingUnauthenticated LDAP requestsUse of inefficient APIsLow maintainability with old Android featuresInefficient retrieval of first page of DynamoDB resultsAtomicity violationMissing handling of specifically-thrown exceptionsWeak obfuscation of web requestDynamo mapper has items ruleVarargs position errorClear text credentialsHttp handler orderingSession fixationComplicated DynamoDB query with expression attribute valuesPoor logging practice ruleSyntax error in fileCatching and not re-throwing or logging exceptionsMissing check when launching an Android activity with an implicit intentClient constructor deprecationInefficient use of stream sortingIncorrect File PermissionsArithmetic overflow or underflowSimplifiable codeLoose file permissionsPreferred DynamoDB GetKeys API not usedManual paginationIncorrect string equality operatorInefficient chain of AWS API callsOS command injectionInternationalizationCode cloneSQL injectionMissing check on method outputMissing paginationCoral server side request forgeryUntrusted data in http sessionGet records with limit ruleResources used by an Amazon S3 TransferManager are not releasedInsecure cryptographyMissing timezone of SimpleDateFormatHardcoded Active JDBC Credentials in JavaLow maintainability with low class cohesionJson object refactoring ruleOversynchronizationMissing release of resources ruleMissing authorizationInfinite loopBatch operations preferred over loopingInconsistent null checkApplication logging of sensitive dataObject Input Stream Insecure DeserializationWeak pseudorandom number generationInsecure CORS policyMissing handling of file deletion resultAmazon SQS message visibility changed without a status checkState machine execution ARN is not loggedClient-side KMS reencryptionUnlogged exceptions in a stack traceUse Stream::anyMatch instead of Stream::findFirst or Stream::findAnyUnterminated switch case blocksBatch request with unchecked failuresBuffer underflow prevention
High
Showing all detectors for the Java language with high severity.
Reflected cross site scripting
Rule to detect reflected XSS.
AWS object presence check
Manually performing an object existence check is inefficient when a built-in operation is available.
Incorrect type conversion or cast
The software does not correctly convert an object, resource, or structure from one type to a different type.
Missing Authentication
Missing authentication checks can lead to unauthorized access to a resource or performance of an action.
Missing timeout check on CountDownLatch.await
Missing timeout check on CountDownLatch.await can cause synchronization errors.
Unspecified default value
Unspecified defaults can cause your application to crash.
Deserialization of untrusted object
Deserialization of untrusted objects can lead to security vulnerabilities such as, inadvertently running remote code.
Preserve thread interruption status rule
Preserve Thread Interruption Status Rule.
Missing null check for cache response metadata
Accessing the cache response metadata without performing a
null check might cause a null dereference error.Insecure connection using unencrypted protocol
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
Insecure Usage Of Cache
Passing StringByteConverter to Cache could cause buffer access length errors.
Insecure Cryptographic Cipher
Insecure Cryptographic Cipher
Use of externally-controlled input to build connection string
Use of unsanitized user input to build connection strings can allow attackers to bypass security checks and access restricted resources.
Mutually exclusive call
Calls to mutually exclusive methods were found in the code.
Application logging of sensitive object data
Application logging of sensitive object data
Improper Initialization
The code failed to initialize or incorrectly initialized internal data, leading to undefined behavior.
Unexpected re-assignment of synchronized objects
Synchronized objects should not be re-assigned in the same
synchronized block because the references to the synchronized object would be lost.XPath injection
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.
Transitive auth rule
Rule for detecting lack of transitive auth.
Denial of service rule
A denial of service (DOS) attack can make a critical resource unavailable for legitimate users.
XML Validation
Objects that parse or handle XML in XML document can lead to XML External Entity (XXE) attacks when misconfigured.
Input and output values become out of sync
If a method that uses an input parameter to update an output value throws an exception, then the output value is not updated.
Server-side request forgery
Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.
Missing Authorization for address id
Rule to detect lack of authorization check when using address ID.
Not recommended aws credentials classes
Find usages of not recommended classes for AWS Credentials and suggest replacing them with something else.
Path traversal
Creating file paths from untrusted input might give a malicious actor access to sensitive files.
Override of reserved variable names in a Lambda function
Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.
Insecure Trust Manager
Insecure Trust Manager can allow connection to a host that is not signed by a trusted authority.
Usage of an API that is not recommended
APIs that are not recommended were found.
Weak Initialization Vector (IV)
Using a static or predictable initialization vector (IV) for a cryptographic cipher is security sensitive.
Insecure JSON web token (JWT) parsing
JWTs should not be parsed using the
parse method.Unchecked S3 object metadata content length
Failure to specify a content length causes the contents of the input stream to buffer locally in memory in order to calculate its length. This can result in performance problems.
Fortify Process Control
Checks whether
System.loadLibrary is used.Untrusted data in security decision
Security decisions should not depend on branching that can be influenced by untrusted or client-provided data.
Permissive cors configuration rule
Rule to enable detection for potential CORS vulnerabilities in services using the Coral or Spring frameworks.
XML External Entity
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
AWS Region Handling in Java.
Prefer RegionUtils over Regions and S3Regions enums for easy support of new AWS regions.
LDAP injection
LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.
Log injection
Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.
Sensitive information leak
Sensitive information should not be exposed through log files or stack traces.
Synchronous publication of AWS Lambda metrics
Synchronous publication of AWS Lambda metrics is inefficient.
XML External Entity Document Builder Factory
Objects that parse or handle XML in XML document can lead to XML External Entity (XXE) attacks when misconfigured.
Authorization Bypass Through User-Controlled Key
The system's authorization does not prevent a user from accessing another user's data by modifying key values.
Insecure TLS version
TLS versions older than TLS version 1.1 support weak, broken, or misconfigured cryptography.
Logging of sensitive information
The logging of sensitive information can expose the information to potential attackers.
Improper Neutralization of Input Used in a Command (Command Injection)
Improper Neutralization of Input Used in a Command (Command Injection)
Proper usage of Pattern matches.
Compile regex pattern only once and reuse for all iterations when processing loops or streams.
Insecure SAML parser configuration
Comment parsing for OpenSAML2 might enable an attacker to bypass authentication.
Cross-site request forgery
Insecure configuration can lead to a cross-site request forgery (CSRF) vulnerability.
Case sensitive keys in S3 object user metadata
User metadata keys are case insensitive and are returned as lowercase strings, even if they were originally specified with uppercase strings.
TLS certificate verification
The application does not verify server certification for TLS connection.
Thread safety violation
A thread safety violation might indicate a data race which can put the system into an inconsistent state.
URL redirection to untrusted site
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Use of externally-controlled input to select classes or code
Use of unsanitized external input in reflection can allow attackers to bypass security checks and run malicious code.
Missing encryption of sensitive data in storage
Sensitive data is potentially persisted into storage or passed to another service without always being encrypted.
Cross-site scripting
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Unauthenticated LDAP requests
Unauthenticated LDAP requests can allow untrusted access to LDAP servers.
Weak obfuscation of web request
Weak obfuscation while configuring a web request
Varargs position error
A
Varargs position error was detectedClear text credentials
Credentials that are stored in clear text can be intercepted by a malicious actor.
Syntax error in file
Some files contain syntax errors.
Incorrect File Permissions
Improperly set permissions can lead to excessive access or restricted functionality, posing security risks.
Loose file permissions
Weak file permissions can lead to privilege escalation.
OS command injection
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
SQL injection
Use of untrusted inputs in SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Coral server side request forgery
Checks if data from request object is passed to new server-side requests without validation in a Coral service.
Missing authorization
Missing authorization checks can lead to unauthorized access to a resource or performance of an action.
Application logging of sensitive data
Application logging of sensitive data
Object Input Stream Insecure Deserialization
Deserialization of untrusted data without sufficiently verifying that the resulting data will be valid.
Weak pseudorandom number generation
Insufficiently random generators (or hardcoded seeds) can make pseudorandom sequences predictable.
Client-side KMS reencryption
Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.