Amazon Q
Detector Library
Java detectors (186/186)
Reflected cross site scriptingMandatory method not called after object creationProcess empty record list in Amazon KCLAmazon STS regional instead of global endpointAWS object presence checkPoor error handling java ruleIncorrect type conversion or castMissing AuthenticationMissing timeout check on CountDownLatch.awaitUnspecified default valueDevice Permission Usage.Check eagle handler and authn handler orderingDeserialization of untrusted objectPreserve thread interruption status ruleMissing check on the value returned by moveToFirst APIMissing timeout check on ExecutorService.awaitTerminationOverflow when deserializing relational database objectsCustom manual retries of AWS SDK callsMissing null check for cache response metadataInefficient usage of Transaction library from AWS LabsInefficient exception handlingInsecure connection using unencrypted protocolInsecure Usage Of CacheInsecure Cryptographic CipherUse of a deprecated methodError-prone AWS IAM policy creationUse of externally-controlled input to build connection stringInefficient Amazon S3 manual paginationMutually exclusive callBit shift checkingAWS Lambda client not reusedMissing check on the result of createNewFileSensitive data stored unencrypted due to partial encryptionApplication logging of sensitive object dataMissing AWS_SECURITY_TOKENMissing statement to record cause of InvocationTargetExceptionMisconfigured ConcurrencyInefficient polling of AWS resourceImproper InitializationUnexpected re-assignment of synchronized objectsXPath injectionTransitive auth ruleAWS client not reused in a Lambda functionDenial of service ruleHTTP Connection Not ClosedLong polling is not enabled in Amazon SQSXML ValidationInsecure temporary file or directoryUse of low-Level functionalityHTTP response splittingInput and output values become out of syncUse String To Store Aws Account IdServer-side request forgeryMissing Authorization for address idDo not catch and throw exceptionConcurrency deadlockCheck mutable property in handler classNot recommended aws credentials classesPath traversalOverride of reserved variable names in a Lambda functionMissing byte array length of JSON parserInsecure Trust ManagerUsage of an API that is not recommendedHardcoded credentialsWeak Initialization Vector (IV)Insecure JSON web token (JWT) parsingNot calling finalize causes skipped cleanup stepsUnchecked S3 object metadata content lengthFortify Process ControlUntrusted data in security decisionPermissive cors configuration ruleInsecure cookieResource leakXML External EntityAWS client credentialsAWS Region Handling in Java.Allow-listing pre-production service principals to productionWrapping Caught Invocation Target ExceptionBad parameters used with AWS API methodsMissing position check before getting substringLDAP injectionAvoid reset exception in Amazon S3Insecure hashingBackward compatibility breaks with error message parsingInefficient map entry iterationMissing S3 bucket owner conditionAWS DynamoDB getItem output is not null checkedInvalid public method parametersLog injectionSensitive information leakUsage of multiple date time pattern formatterZip StreamingSynchronous publication of AWS Lambda metricsXML External Entity Document Builder FactoryImproper use of classes that aren't thread-safeIncorrect null check before setting a valueAuthorization Bypass Through User-Controlled KeyCheck uncaught exceptionsInsufficient use of name in Amazon SQS queueMissing check on the value returned by ResultSet.nextInsecure TLS versionUnsanitized input is run as codeLogging of sensitive informationUse an enum to specify an AWS RegionImproperly formatted string argumentsImproper Neutralization of Input Used in a Command (Command Injection)throw inside finallyProper usage of Pattern matches.Untrusted AMI imagesInsecure SAML parser configurationCross-site request forgeryCase sensitive keys in S3 object user metadataMissing null check when retrieving the owner of an Amazon S3 objectTLS certificate verificationStack trace not included in re-thrown exceptionThread safety violationRegion specification missing from AWS client initializationInsufficient number of PBEKeySpec iterationsURL redirection to untrusted siteUse of externally-controlled input to select classes or codeMissing encryption of sensitive data in storageIgnored output of DynamoDBMapper operationsInvoking String comparison method with null StringNull pointer dereferenceCross-site scriptingUnauthenticated LDAP requestsUse of inefficient APIsLow maintainability with old Android featuresInefficient retrieval of first page of DynamoDB resultsAtomicity violationMissing handling of specifically-thrown exceptionsWeak obfuscation of web requestDynamo mapper has items ruleVarargs position errorClear text credentialsHttp handler orderingSession fixationComplicated DynamoDB query with expression attribute valuesPoor logging practice ruleSyntax error in fileCatching and not re-throwing or logging exceptionsMissing check when launching an Android activity with an implicit intentClient constructor deprecationInefficient use of stream sortingIncorrect File PermissionsArithmetic overflow or underflowSimplifiable codeLoose file permissionsPreferred DynamoDB GetKeys API not usedManual paginationIncorrect string equality operatorInefficient chain of AWS API callsOS command injectionInternationalizationCode cloneSQL injectionMissing check on method outputMissing paginationCoral server side request forgeryUntrusted data in http sessionGet records with limit ruleResources used by an Amazon S3 TransferManager are not releasedInsecure cryptographyMissing timezone of SimpleDateFormatHardcoded Active JDBC Credentials in JavaLow maintainability with low class cohesionJson object refactoring ruleOversynchronizationMissing release of resources ruleMissing authorizationInfinite loopBatch operations preferred over loopingInconsistent null checkApplication logging of sensitive dataObject Input Stream Insecure DeserializationWeak pseudorandom number generationInsecure CORS policyMissing handling of file deletion resultAmazon SQS message visibility changed without a status checkState machine execution ARN is not loggedClient-side KMS reencryptionUnlogged exceptions in a stack traceUse Stream::anyMatch instead of Stream::findFirst or Stream::findAnyUnterminated switch case blocksBatch request with unchecked failuresBuffer underflow prevention
Medium
Showing all detectors for the Java language with medium severity.
Process empty record list in Amazon KCL
Setting
withCallProcessRecordsEvenForEmptyRecordList to TRUE during Kinesis Client Library (KCL) initialization will treat empty records differently.Amazon STS regional instead of global endpoint
Use
setRegion and setEndpoint methods to make calls to Regional Amazon STS endpoints.Device Permission Usage.
Do not use API that requests system permission directly. Please onboard mShop Permission Service first.
Check eagle handler and authn handler ordering
EagleHandler must appear after AuthNHandler to make sure that all authenticated calls are correctly logged.
Missing check on the value returned by moveToFirst API
Missing check on the value returned by moveToFirst API can cause your application to crash.
Overflow when deserializing relational database objects
Deserializing objects from relational databases should allocate a 64-bit, not 32-bit, type for the auto-incremented identifier.
Custom manual retries of AWS SDK calls
Custom manual retries of calls to AWS SDK APIs are inefficient.
Use of a deprecated method
This code uses deprecated methods, which suggests that it has not been recently reviewed or maintained.
Bit shift checking
Rule to detect bit shifting.
AWS Lambda client not reused
Reuse AWS clients in Lambda.
Sensitive data stored unencrypted due to partial encryption
Encryption that is dependent on conditional logic, such as an
if...then clause, might cause unencrypted sensitive data to be stored.Missing AWS_SECURITY_TOKEN
Set the
AWS_SECURITY_TOKEN attribute for IAM with temporary credentials.AWS client not reused in a Lambda function
Recreating AWS clients in each Lambda function invocation is expensive.
HTTP Connection Not Closed
Neglecting to close opened resources in the finally block in Java violates resource management principles, risking resource leaks and performance issues.
Long polling is not enabled in Amazon SQS
Enable long polling for efficiency.
Insecure temporary file or directory
Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.
Use of low-Level functionality
Use of low level functionality in application development which is prohibited by the framework or specification under which the application is supposed to operate.
Use String To Store Aws Account Id
When using AWS AccountId it is advisable to use String datatype instead of numeric types to avoid leading zero truncation.
Concurrency deadlock
Improper use of locks in a multi-threaded program can lead to deadlock and cause the program to be unresponsive.
Check mutable property in handler class
Rule to detect any Handler class with a mutable property that can be accessed via the Job object passed to the before/after method.
Missing byte array length of JSON parser
Specify the length of the input byte array when creating a
JSON parser to avoid a deserialization problem.Not calling finalize causes skipped cleanup steps
Always call
super.finalize explicitly.Resource leak
Allocated resources are not released properly.
AWS client credentials
Pass Credentials provider instead of credential to account for automatic credential rotation.
Allow-listing pre-production service principals to production
Allow-listing pre-production service principals to production
Wrapping Caught Invocation Target Exception
Recommends type-casting the exception into unchecked exception and throwing it.
Bad parameters used with AWS API methods
An outdated or bad parameters were detected in calls to some AWS API methods.
Missing position check before getting substring
Getting a substring outside the range of a string can cause an index-out-of-bounds exception.
Avoid reset exception in Amazon S3
Uploading objects to Amazon S3 by using streams (either through an AmazonS3 client or
TransferManager) might encounter network connectivity or timeout issues.Insecure hashing
Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.
AWS DynamoDB getItem output is not null checked
Outputs of AWS DynamoDB's
GetItem method are not null checked.Invalid public method parameters
Public method parameters should be validated for nullness, unexpected values, and malicious values.
Usage of multiple date time pattern formatter
Detects the usage of multiple date time pattern.
Zip Streaming
Parsing ZIP files using streaming.
Improper use of classes that aren't thread-safe
Improper use of thread-unsafe classes in multi-threaded programs can cause the programs to be unstable.
Incorrect null check before setting a value
When a variable is assigned a value after checking if it's not
null (for example, x != null insead of x == null), it might be inadvertently overwritten.throw inside finally
Writing throw keyword in finally block disrupts logical execution of code, instead write it under catch block.
Untrusted AMI images
Improper filtering of Amazon Machine Images (AMIs) can result in loading an untrusted image, a potential security vulnerability.
Missing null check when retrieving the owner of an Amazon S3 object
Missing
null check when retrieving the owner of an Amazon S3 object can result in a null dereference error.Stack trace not included in re-thrown exception
When re-throwing an exception, make sure to include the stack trace.
Insufficient number of PBEKeySpec iterations
Using less than 1,000 PBEKeySpec iterations is insecure.
Invoking String comparison method with null String
Invoking String comparison method with null String can lead to NullPointerException.
Null pointer dereference
Dereferencing a null pointer can lead to unexpected null pointer exceptions.
Use of inefficient APIs
Performance of this code can be enhanced by using alternative APIs.
Low maintainability with old Android features
Code uses older Android features.
Dynamo mapper has items rule
The API
hasItems returns true if the service returned a value for the Items property.Http handler ordering
JsonHttpBindingHandler should occur in your code before the HttpRpcHandler.
Catching and not re-throwing or logging exceptions
It's not good practice to catch an exception and then re-throw or log it.
Inefficient use of stream sorting
Using
Stream::min or Stream::max is more efficient than sorting and getting the first element in a stream.Arithmetic overflow or underflow
Use numeric types that are large enough to hold the result of arithmetic operations.
Incorrect string equality operator
Use
equals(), not ==, when checking if two strings are equal.Inefficient chain of AWS API calls
The chain of API calls can be replaced with a single, more efficient API call.
Internationalization
Improper use of locals prevent internationalization.
Code clone
Similar code fragments were detected in the same file.
Missing pagination
Additional results are not checked for a paginated API call. This might produce inaccurate results.
Untrusted data in http session
User input in
setAttribute could lead to trust boundary violation.Get records with limit rule
The API
GetRecordsRequest.withLimit(limit) returns the number of records that is specified by the limit parameter.Resources used by an Amazon S3 TransferManager are not released
Call
ShutdownNow when you use TransferManager to manage transfers to Amazon S3.Missing timezone of SimpleDateFormat
Using a
SimpleDateFormat object without setting its timezone can result in unexpected date and time.Low maintainability with low class cohesion
Classes with low class cohesion contain unrelated operations which make them difficult to understand and less likely to be used.
Json object refactoring rule
Json object refactoring rule.
Missing release of resources rule
Resources requiring explicit closure must be properly released to prevent leaks
Infinite loop
Use loop control flow to ensure that loops are exited, even if exceptional behaviors are encountered.
Inconsistent null check
A missing null check might cause a null dereference error.
Insecure CORS policy
Cross-Origin Resource Sharing policies that are too permissive may lead to security vulnerabilities.
Missing handling of file deletion result
Unhandled failures of deleting files can exhaust file handles.
Unlogged exceptions in a stack trace
When logging an exception, make sure to include the stack trace.
Batch request with unchecked failures
Not checking which items have failed can lead to loss of data.
Buffer underflow prevention
An improper buffer read operation might lead to a
BufferUnderflowException.