Browse all detectors

• AWS object presence check

  An object existence check is performed manually. Use built-in operations instead.

• Deserialization of untrusted object

  Deserialization of untrusted or potentially malformed data can be exploited for denial of service or to induce running untrusted code.

• Device Permission Usage.

  Do not use API that requests system permission directly. Please onboard mShop Permission Service first.

• HTTP response splitting

  Passing data from an untrusted source into a cookie or web response might expose the user to HTTP response splitting attacks. An attacker might send manipulated requests that could inject code into a cookie or the body of the response.

• Inefficient usage of Transaction library from AWS Labs

  DynamoDB transactional APIs provide native, server-side transactions. The AWS Labs Transactions Library is a client-side solution. DynamoDB native transactions are more cost effective and provide better application performance.

• Mandatory method not called after object creation

  Object creation must be followed by mandatory methods that must be called on the created object.

• Missing check on the value returned by moveToFirst API

  You must check if the cursor pointing to the result of a database operation is empty. If a check on the value returned by moveToFirst is missing, subsequent database read operations can cause your application to crash.

• Missing timeout check on ExecutorService.awaitTermination

  If a timeout check on awaitTermination is missing, a subsequent shutdown operation might forcefully terminate an executing thread. This can make your code harder to debug.

• Preserve thread interruption status rule

  InterruptedException is ignored. This can delay thread shutdown and clear the thread’s interrupt status. Only code that implements a thread’s interruption policy can swallow an interruption request.

• Process empty record list in Amazon KCL

  Processing empty records from getRecords operations is more efficient by setting withCallProcessRecordsEvenForEmptyRecordList to TRUE during Kinesis Client Library (KCL) initialization. This will allow for differentiation of empty records so that they may be treated differently.

• Reflected cross site scripting

  Rule for detecting reflected cross-site scripting in code that uses the Spring or Horizonte framework.

• Unspecified default value

  This code uses an API for whom a default value must be specified. Unspecified default values can cause your application to crash.