Amazon QDetector Library Sign in to Amazon Q

Amazon Q

Detector Library

JSX detectors (92/92)

Protection mechanism failure Log injection Insecure connection using unencrypted protocol File Race Bad Use of a deprecated method AWS credentials logged Improper input validation Insecure cryptography Catch and swallow exception File and directory information exposure Origins-verified cross-origin communications SQL injection Non-literal regular expression Typeof expression Batch request with unchecked failures Pseudorandom number generators Cryptographic key generator Server-side request forgery Sensitive information leak File injection String passed to `setInterval` or `setTimeout`Cross-site request forgery Use {} instead of new Object()Usage of an API that is not recommended Tainted input for Docker API Cross-site scripting Improper handling of case sensitivity Weak obfuscation of web requests Unauthenticated Amazon SNS unsubscribe requests might succeed Set SNS Return Subscription ARN XML external entity Resource leak Improper access control Items removed from an array using delete Loose file permissions Avoid Undefined As Variable Name Untrusted data in security decision OS command injection Ajv AllErrors True Client-side KMS reencryption Insecure CORS policy Inefficient polling of AWS resource New function detected Missing pagination Avoid nan in comparison Header injection Hardcoded credentials File extension validation NoSQL injection Redundant switch statement Missing Amazon S3 bucket owner condition Disabled HTML autoescape Least privilege violation URL redirection to untrusted site Clear text credentials Insufficiently protected credentials Insecure hashing Unsanitized input is run as code Check failed records when using kinesis Untrusted Amazon Machine Images Session fixation Data loss in a batch request Type confusion Lazy Load Module XPath injection Deserialization of untrusted object Invoke super appropriately Missing check on method output Stack trace exposure Timing attack LDAP injection Insecure cookie Sensitive data stored unencrypted due to partial encryption Unvalidated expansion of archive files Integer overflow SNS don't bind subscribe and publish Unverified hostname Improper restriction of rendered UI layers or frames AWS client not reused in a Lambda function Path traversal Override of reserved variable names in a Lambda function Insecure temporary file or directory Logging of sensitive information Hardcoded IP address Insecure object attribute modification Index of method comparison Sensitive query string Numeric truncation error DNS prefetching Limit request length Sendfile injection Improper certificate validation

Code Quality detectors

Catch and swallow exception

Swallowing exceptions, without rethrowing or logging them, can make it hard to understand why your application is failing.

Typeof expression

The typeof operator should only be compared to valid values.

String passed to `setInterval` or `setTimeout`

String passed to setInterval or setTimeout can cause the JavaScript engine to evaluate, which can lead to a security risk.

Use {} instead of new Object()

New Object() has been used for object creation instead of {}.

Items removed from an array using delete

Items removed from an array using delete can cause undefined holes in the array.

Avoid Undefined As Variable Name

Checks if the undefined is used as variable.

Inefficient polling of AWS resource

Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.

New function detected

Use of new Function() can be dangerous if used to evaluate dynamic content.

Avoid nan in comparison

Checks if nan is used is comparison.

Redundant switch statement

Detect switch statements if it has less than three case clauses.

Check failed records when using kinesis

A batch request that doesn't check for failed records can lead to loss of data.

Lazy Load Module

Checks for lazy module loading.

Invoke super appropriately

The incorrect use of super() causes problems.

Missing check on method output

Missing checks might cause silent failures that are harder to debug.

Index of method comparison

indexOf method should not be compared with values greater than zero.

Numeric truncation error

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.