Solutions Library

Java detectors (12/12)

Unspecified default value

Unspecified default value

High
This code uses an API for whom a default value must be specified. Unspecified default values can cause your application to crash.
Detector ID
java/unspecified-default-value@v1.0
Category
Security
Tags
  • security-context
  • availability
Common Weakness Enumeration (CWE) 

Noncompliant example

private Channel createChannelNonCompliant(URI uri) {
    // Noncompliant: default value for the port number is not specified.
    return NettyChannelBuilder.forAddress(uri.getHost(), uri.getPort())
        .negotiationType(NegotiationType.PLAINTEXT)
        .build();
}

Compliant example

private Channel createChannelCompliant(URI uri) {
    int port = uri.getPort();
    // Compliant: default value for the port number is specified.
    if (port == -1) {
        port = 11984;
    }
    return NettyChannelBuilder.forAddress(uri.getHost(), port)
        .negotiationType(NegotiationType.PLAINTEXT)
        .build();
}