Amazon CodeGuruDetector Library Sign in to CodeGuru

CodeGuru

Detector Library

TypeScript detectors (105/105)

Integer overflow AWS insecure transmission CDK Insecure cookie AWS credentials logged SQL injection Insecure connection using unencrypted protocol New function detected Batch request with unchecked failures Unvalidated expansion of archive files Missing pagination XPath injection Logging of sensitive information Override of reserved variable names in a Lambda function Insecure CORS policy Improper input validation Hardcoded credentials Invoke super appropriately Numeric truncation error Avoid nan in comparison Missing check on method output Insufficiently protected credentials Improper restriction of rendered UI layers or frames Pseudorandom number generators AWS missing encryption CDK Catch and swallow exception Header injection Use {} instead of new Object()Hardcoded IP address Untrusted Amazon Machine Images Weak obfuscation of web requests File Race Bad Improper certificate validation Sendfile injection Cryptographic key generator improper input validation cdk XML external entity Timing attack Missing Amazon S3 bucket owner condition Insecure hashing Session fixation Use of Default Credentials CDK File injection Improper Restriction of Operations within the Bounds of a Memory Buffer Limit request length Log injection Type confusion Server side request forgery aws kmskey encryption cdk Inefficient polling of AWS resource Avoid Undefined As Variable Name Index of method comparison String passed to `setInterval` or `setTimeout`Data loss in a batch request Tainted input for Docker API Insecure temporary file or directory Check failed records when using kinesis AWS api logging disabled cdk Improper Access Control CDK Least privilege violation File extension validation Resource leak Set SNS Return Subscription ARN Insecure object attribute modification Missing Authentication for Critical Function CDK Typeof expression AWS missing encryption of sensitive data cdk Unauthenticated Amazon SNS unsubscribe requests might succeed Cross-site request forgery Client-side KMS reencryption Insecure cryptography Deserialization of untrusted object Clear text credentials Improper handling of case sensitivity Unsanitized input is run as code Protection mechanism failure Use of a deprecated method Sensitive information leak DNS prefetching Exposure of Sensitive Information CDK Insecure JWT parsing Loose file permissions Missing Authorization CDK Sensitive query string Insufficient Logging CDK OS command injection NoSQL injection Unverified hostname Path traversal Origins-verified cross-origin communications LDAP injection SNS don't bind subscribe and publish S3 partial encrypt CDK Non-literal regular expression Stack trace exposure File and directory information exposure Usage of an API that is not recommended Lazy Load Module Disabled HTML autoescape Improper access control Redundant switch statement Cross-site scripting Sensitive data stored unencrypted due to partial encryption AWS client not reused in a Lambda function URL redirection to untrusted site Untrusted data in security decision

Code Quality detectors

New function detected

Use of new Function() can be dangerous if used to evaluate dynamic content.

Invoke super appropriately

The incorrect use of super() causes problems.

Numeric truncation error

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

Avoid nan in comparison

Checks if nan is used is comparison.

Missing check on method output

Missing checks might cause silent failures that are harder to debug.

Catch and swallow exception

Swallowing exceptions, without rethrowing or logging them, can make it hard to understand why your application is failing.

Use {} instead of new Object()

New Object() has been used for object creation instead of {}.

improper input validation cdk

Improper input validation can enable attacks and lead to unwanted behavior.

Use of Default Credentials CDK

The product relies on default credentials(including passwords and cryptographic keys) for potentially vital functions.

Improper Restriction of Operations within the Bounds of a Memory Buffer

An improper buffer read operation might lead to a BufferOverflowException.

Inefficient polling of AWS resource

Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.

Avoid Undefined As Variable Name

Checks if the undefined is used as variable.

Index of method comparison

indexOf method should not be compared with values greater than zero.

String passed to `setInterval` or `setTimeout`

String passed to setInterval or setTimeout can cause the JavaScript engine to evaluate, which can lead to a security risk.

Check failed records when using kinesis

A batch request that doesn't check for failed records can lead to loss of data.

Improper Access Control CDK

The software does not restrict or incorrectly restrict access to a resource from an unauthorized actor.

Missing Authentication for Critical Function CDK

Missing authentication checks can lead to unauthorized access to a resource or performance of an action.

Typeof expression

The typeof operator should only be compared to valid values.

Exposure of Sensitive Information CDK

The product unintentionally grants unauthorized actors access to a resource by placing it in the wrong control sphere.

Insufficient Logging CDK

In the case of a security-critical event, the product fails to either log the event or misses crucial details in the logged information.

Lazy Load Module

Checks for lazy module loading.

Redundant switch statement

Detect switch statements if it has less than three case clauses.