Tag: security-context

Unspecified default value

Unspecified defaults can cause your application to crash.

Missing check on the value returned by moveToFirst API

Missing check on the value returned by moveToFirst API can cause your application to crash.

Overflow when deserializing relational database objects

Deserializing objects from relational databases should allocate a 64-bit, not 32-bit, type for the auto-incremented identifier.

Mutually exclusive call

Calls to mutually exclusive methods were found in the code.

AWS Lambda client not reused

Reuse AWS clients in Lambda.

Missing check on the result of createNewFile

Missing check on the result of createNewFile might cause data loss.

Unexpected re-assignment of synchronized objects

Synchronized objects should not be re-assigned in the same synchronized block because the references to the synchronized object would be lost.

AWS client not reused in a Lambda function

Recreating AWS clients in each Lambda function invocation is expensive.

Input and output values become out of sync

If a method that uses an input parameter to update an output value throws an exception, then the output value is not updated.

Concurrency deadlock

Improper use of locks in a multi-threaded program can lead to deadlock and cause the program to be unresponsive.

Override of reserved variable names in a Lambda function

Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.

Usage of an API that is not recommended

APIs that are not recommended were found.

Not calling finalize causes skipped cleanup steps

Always call super.finalize explicitly.

Unchecked S3 object metadata content length

Failure to specify a content length causes the contents of the input stream to buffer locally in memory in order to calculate its length. This can result in performance problems.

Bad parameters used with AWS API methods

An outdated or bad parameters were detected in calls to some AWS API methods.

Avoid reset exception in Amazon S3

Uploading objects to Amazon S3 by using streams (either through an AmazonS3 client or TransferManager) might encounter network connectivity or timeout issues.

Missing S3 bucket owner condition

Not setting the S3 bucket owner condition might introduce a risk of accidentally using a wrong bucket.

Missing check on the value returned by ResultSet.next

Missing check on the value returned by ResultSet.next can cause your application to crash.

Case sensitive keys in S3 object user metadata

User metadata keys are case insensitive and are returned as lowercase strings, even if they were originally specified with uppercase strings.

Stack trace not included in re-thrown exception

When re-throwing an exception, make sure to include the stack trace.

Ignored output of DynamoDBMapper operations

Check if errors are returned by DynamoDBMapper's BatchWrite operations.

Null pointer dereference

Dereferencing a null pointer can lead to unexpected null pointer exceptions.

Atomicity violation

Atomicity violations caused by improper usage of ConcurrentHashMap or ConcurrentLinkedQueue can result in crashses or incorrect program results.

Missing handling of specifically-thrown exceptions

Catching generic exceptions might hide issues when specific exceptions are thrown.

Catching and not re-throwing or logging exceptions

It's not good practice to catch an exception and then re-throw or log it.

Missing check when launching an Android activity with an implicit intent

Your application can crash if the check for an application that can receive the implicit intent is missing from code.

Arithmetic overflow or underflow

Use numeric types that are large enough to hold the result of arithmetic operations.

Missing pagination

Additional results are not checked for a paginated API call. This might produce inaccurate results.

Resources used by an Amazon S3 TransferManager are not released

Call ShutdownNow when you use TransferManager to manage transfers to Amazon S3.

Missing timezone of SimpleDateFormat

Using a SimpleDateFormat object without setting its timezone can result in unexpected date and time.

Weak pseudorandom number generation

Insufficiently random generators (or hardcoded seeds) can make pseudorandom sequences predictable.

Missing handling of file deletion result

Unhandled failures of deleting files can exhaust file handles.