537 个项目已找到
弱点
Abstract
非只读模式的 Castor 查询可能会影响性能。
Explanation
即便 castor 创建了对象的锁定,也不能阻止其他线程对该对象执行读取或写入。另外,与默认的共享模式相比,只读模式的查询的运行速度大约是前者的 7 倍。

例 1:下例指定 SHARED 查询模式,该模式允许读取和写入访问。

results = query.execute(Database.SHARED);
References
[1] ExoLab Group Castor JDO - Best practice
[2] Standards Mapping - Common Weakness Enumeration CWE ID 265
[3] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.14.5 Configuration Architectural Requirements (L2 L3)
[4] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 7.1.1
[5] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 7.1.1
[6] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 7.1.2
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 7.1.2
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 7.1.2
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 7.1.2
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 7.2.2
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 7.2.2
[12] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control
[13] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control
[14] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls
[15] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II
desc.structural.java.castor_bad_practices_query_mode_not_read_only
Abstract
该 Castor 查询未明确定义查询模式。
Explanation
默认情况下,Castor 以共享模式执行查询。由于共享模式允许读取访问和写入访问,因此该查询需要采取何种操作并不清楚。如果要在只读上下文中使用该对象,则共享访问会增加不必要的性能负担。

例 1:以下示例未指定查询模式。

results = query.execute(); //missing query mode
References
[1] ExoLab Group Castor JDO - Best practice
[2] Standards Mapping - Common Weakness Enumeration CWE ID 265
[3] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.14.5 Configuration Architectural Requirements (L2 L3)
[4] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 7.1.1
[5] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 7.1.1
[6] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 7.1.2
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 7.1.2
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 7.1.2
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 7.1.2
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 7.2.2
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 7.2.2
[12] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control
[13] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control
[14] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls
[15] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II
desc.semantic.java.castor_bad_practices_unspecified_query_mode
Abstract
使用 ActionForms 的 Struts 1 应用程序容易受到 ClassLoader Manipulation 攻击。
Explanation
攻击者可以通过 ClassLoader Manipulation 攻击访问和修改底层应用程序服务器设置。在某些应用程序服务器(例如,Tomcat 8)上,攻击者可能会调整这些设置,以上传 web shell 并执行任意命令。
References
[1] Protect your Struts1 applications Alvaro Muñoz
[2] Standards Mapping - Common Weakness Enumeration CWE ID 470
[3] Standards Mapping - Common Weakness Enumeration Top 25 2024 [12] CWE ID 020
[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002754
[5] Standards Mapping - FIPS200 SI
[6] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)
[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation
[9] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls
[10] Standards Mapping - OWASP Top 10 2004 A1 Unvalidated Input
[11] Standards Mapping - OWASP Top 10 2007 A4 Insecure Direct Object Reference
[12] Standards Mapping - OWASP Top 10 2010 A4 Insecure Direct Object References
[13] Standards Mapping - OWASP Top 10 2013 A4 Insecure Direct Object References
[14] Standards Mapping - OWASP Top 10 2017 A5 Broken Access Control
[15] Standards Mapping - OWASP Top 10 2021 A03 Injection
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.1
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.4
[18] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8
[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8
[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8
[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8
[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8
[23] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[24] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[25] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control
[26] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control
[27] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls
[28] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I, APP3570 CAT I
[29] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I, APP3570 CAT I
[30] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I, APP3570 CAT I
[31] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I, APP3570 CAT I
[32] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I, APP3570 CAT I
[33] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I, APP3570 CAT I
[34] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I, APP3570 CAT I
[35] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002560 CAT I
[36] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002560 CAT I
[37] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002560 CAT I
[38] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002560 CAT I
[39] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002560 CAT I
[40] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002560 CAT I
[41] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002560 CAT I
[42] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002560 CAT I
[43] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002560 CAT I
[44] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002560 CAT I
[45] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002560 CAT I
[46] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002560 CAT I
[47] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002560 CAT I
[48] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002560 CAT I
[49] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002560 CAT I
[50] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)
desc.config.java.classloader_manipulation_struts_one
Abstract
将字节数组转换为 String 会导致数据丢失。
Explanation
在将字节数组的数据转换为 String 后,没有说明适用字符集外的数据会发生何种变化。这会导致数据丢失,或者在需要二进制数据来确保执行正确的安全措施时,安全级别降低。

示例 1:以下代码将数据转换为字符串,以便创建散列值。


...
FileInputStream fis = new FileInputStream(myFile);
byte[] byteArr = byte[BUFSIZE];
...
int count = fis.read(byteArr);
...
String fileString = new String(byteArr);
String fileSHA256Hex = DigestUtils.sha256Hex(fileString);
// use fileSHA256Hex to validate file
...


如果文件的大小小于 BUFSIZE,只要 myFile 中的信息已编码为与默认字符集相同,此方式就会很有用。但是,如果使用不同的编码方式,或者为二进制文件,则信息将会丢失。进而导致生成的 SHA 散列值的可靠性降低,并且也将更容易产生冲突,在默认字符集外的数据由相同的值(如问号)表示时,尤其如此。
References
[1] STR03-J. Do not encode noncharacter data as a string CERT
[2] When 'EFBFBD' and Friends Come Knocking: Observations of Byte Array to String Conversions GDS Security
[3] Standards Mapping - Common Weakness Enumeration CWE ID 486
desc.semantic.java.code_correctness_byte_array_to_string_conversion
Abstract
调用 notify() 时将唤醒哪个线程并不确定。
Explanation
通过调用 notify() 无法指定将唤醒哪个线程。

例 1:在下列代码中,notifyJob() 调用 notify()

public synchronized notifyJob() {
flag = true;
notify();
}
...
public synchronized waitForSomething() {
while(!flag) {
try {
wait();
}
catch (InterruptedException e)
{
...
}
}
...
}

在这种情况下,开发人员希望唤醒调用 wait() 的线程,但是 notify() 可能会通知另外的线程。
References
[1] Sun Microsystems, Inc. Java Sun Tutorial - Concurrency
[2] Sun Microsystems, Inc. Java Sun Tutorial - Concurrency
[3] THI02-J. Notify all waiting threads rather than a single thread CERT
[4] Standards Mapping - Common Weakness Enumeration CWE ID 373
desc.structural.java.code_correctness_call_to_notify
Abstract
调用 sleep() 同时保持锁定可能会导致性能下降以及死锁。
Explanation
如果多个线程尝试获取一个资源上的锁定,在调用 sleep() 的同时保持锁定可导致所有其他线程等待释放该资源,这就会造成性能下降和死锁。

例 1:下列代码调用 sleep() 同时还保持锁定。

ReentrantLock rl = new ReentrantLock();
...
rl.lock();
Thread.sleep(500);
...
rl.unlock();
References
[1] LCK09-J. Do not perform operations that can block while holding a lock CERT
[2] Standards Mapping - Common Weakness Enumeration CWE ID 557
[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000336, CCI-000366, CCI-001094
[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 CM-4 Security Impact Analysis (P2), CM-6 Configuration Settings (P1), SC-5 Denial of Service Protection (P1)
[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 CM-4 Impact Analyses, CM-6 Configuration Settings, SC-5 Denial of Service Protection
[6] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9
[8] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II
[9] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II
[10] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II
[11] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II
[12] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II
[13] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II
[14] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II
[15] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II, APSC-DV-002950 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II, APSC-DV-002950 CAT II
[30] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)
[31] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service
desc.controlflow.java.code_correctness_call_to_sleep_in_lock
Abstract
显式的调用垃圾回收机制可以预示系统性能可能出现的问题。
Explanation
几乎所有的 Java 开发人员都会在工作中碰到这样的情况,有时候某个问题看上去非常神秘,让人难以理解,而且根本调试不出来,好像一点办法都没有,只能将原因归结为垃圾回收机制的问题。特别是当问题与 time and state 相关时,我们可以根据经验进行推断,并找到支持这一理论的根据:插入对 System.gc() 的调用似乎可以使问题迎刃而解。

在我们遇到的绝大多数情况中,调用 System.gc() 并非什么好方法。事实上,过于频繁地调用 System.gc() 会带来性能问题。
References
[1] D. H. Hovermeyer FindBugs User Manual
[2] Standards Mapping - Common Weakness Enumeration CWE ID 730
[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094
[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)
[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection
[6] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9
[8] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II
[9] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II
[10] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II
[11] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II
[12] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II
[13] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II
[14] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II
[15] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II
[30] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)
[31] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service
desc.structural.java.code_correctness_call_to_system_gc
Abstract
程序调用线程的 run() 方法,以此替代 start()
Explanation
在多数情况下,直接调用 Thread 对象的 run() 方法会是一个 bug。程序员本想启用新的控制线程,却意外地调用了 run(),而不是 start(),因此,在调用者的控制线程中执行了 run() 方法。

例 1:以下代码摘自一个 Java 程序,其错误地调用了 run(),而没有调用 start()


Thread thr = new Thread() {
public void run() {
...
}
};

thr.run();
References
[1] THI00-J. Do not invoke Thread.run() CERT
[2] Standards Mapping - Common Weakness Enumeration CWE ID 572
[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094
[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)
[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection
[6] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9
[8] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II
[9] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II
[10] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II
[11] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II
[12] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II
[13] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II
[14] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II
[15] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II
[30] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)
[31] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service
desc.structural.java.code_correctness_call_to_thread_run
Abstract
程序调用了线程的 stop() 方法,这可能会导致资源泄露。
Explanation
在多数情况下,直接调用 Thread 对象的 stop() 方法会是一个 bug。程序员希望阻止线程运行,但是没有意识到这种阻止线程的方式并不合适。Thread 中的 stop() 函数会导致 Thread 对象中的任意位置出现 ThreadDeath 异常,这可能会导致对象出现不一致状态,并且会泄露资源。由于此 API 本质上并不安全,因此很久以前就已弃用。

示例 1:以下内容摘录自 Java 程序,其错误地调用了 Thread.stop()


...
public static void main(String[] args){
...
Thread thr = new Thread() {
public void run() {
...
}
};
...
thr.start();
...
thr.stop();
...
}
References
[1] THI05-J. Do not use Thread.stop() to terminate threads CERT
[2] Why are Thread.stop, Thread.suspend, Thread.resume and Runtime.runFinalizersOnExit Deprecated? Oracle
[3] Standards Mapping - Common Weakness Enumeration CWE ID 572
[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094
[5] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)
[6] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection
[7] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9
[9] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II
[10] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II
[11] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II
[12] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II
[13] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II
[14] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II
[15] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II
[31] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)
[32] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service
desc.semantic.java.code_correctness_call_to_thread_stop
Abstract
这个类实现了 clone() 方法,但没有实现 Cloneable 接口。
Explanation
程序员似乎原本想要这个类实现 Cloneable 接口,因为它已经实现了一个名称为 clone() 的方法。然而,该类并没有实现 Cloneable 接口,同时 clone() 方法也无法正常运行。

例 1:在这个类中,调用 clone() 方法将导致一个 CloneNotSupportedException. 异常


public class Kibitzer {
public Object clone() throws CloneNotSupportedException {
...
}
}

References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 498
[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection
[5] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service
[6] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9
[7] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II
[8] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II
[9] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II
[10] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II
[11] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II
[12] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II
[13] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II
[14] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II
[15] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II
[29] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)
[30] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service
desc.structural.java.code_correctness_class_does_not_implement_cloneable
Abstract
在没有实现 Equals() 的对象上调用了 Equals()
Explanation
当比较对象时,开发人员通常希望比较对象的属性。然而,在没有明确实现 Equals() 的类(或任何超类/接口)上调用 Equals() 会导致调用继承自 System.ObjectEquals() 方法。Object.Equals() 将比较两个对象实例,查看它们是否相同,而不是比较对象成员字段或其他属性。尽管可以合法地使用 Object.Equals(),但这通常表示存在错误代码。

示例 1:

public class AccountGroup
{
private int gid;

public int Gid
{
get { return gid; }
set { gid = value; }
}
}
...
public class CompareGroup
{
public bool compareGroups(AccountGroup group1, AccountGroup group2)
{
return group1.Equals(group2); //Equals() is not implemented in AccountGroup
}
}
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 398
desc.structural.dotnet.code_correctness_class_does_not_implement_equals
Abstract
在没有实现 equals() 的对象上调用了 equals() 方法。
Explanation
当比较对象时,开发人员通常希望比较对象的属性。然而,在没有明确实现 equals() 的类(或任何超类/接口)上调用 equals() 会导致调用继承自 java.lang.Objectequals() 方法。Object.equals() 将比较两个对象实例,查看它们是否相同,而不是比较对象成员字段或其他属性。尽管可以合法地使用 Object.equals(),但这通常表示存在错误代码。

例 1:

public class AccountGroup
{
private int gid;

public int getGid()
{
return gid;
}

public void setGid(int newGid)
{
gid = newGid;
}
}
...
public class CompareGroup
{
public boolean compareGroups(AccountGroup group1, AccountGroup group2)
{
return group1.equals(group2); //equals() is not implemented in AccountGroup
}
}
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 398
desc.structural.java.code_correctness_class_does_not_implement_equals
Abstract
类中的 clone() 方法会调用可以被覆盖的函数。
Explanation
clone() 函数调用了可覆盖的函数后,会导致克隆初始化仅部分完成,或者破坏该克隆。

示例 1:以下 clone() 函数调用了可覆盖的方法。


...
class User implements Cloneable {
private String username;
private boolean valid;
public Object clone() throws CloneNotSupportedException {
final User clone = (User) super.clone();
clone.doSomething();
return clone;
}
public void doSomething(){
...
}
}


由于函数 doSomething() 和其封装类并非 final,这意味着该函数是可覆盖的,这将导致其克隆对象 clone 呈部分初始化状态,如果没有通过意外方式变通逻辑,则会导致错误。
References
[1] MET06-J. Do not invoke overridable methods in clone() CERT
[2] EXTEND-5: Limit the extensibility of classes and methods Oracle
desc.structural.java.code_correctness_clone_invokes_overridable_function
Abstract
如果使用相等运算符而非其 equals() 方法比较框式基元,可能会导致意外行为。
Explanation
在处理框式基元时,如果需要比较相等性,则应调用框式基元的 equals() 方法,而非使用运算符 ==!=。Java 规范具有关于框式转换的如下说明:

"如果框式值 p 是一个整数文本(例如 -128 和 127 之间的整数),或是布尔文本 true 或 false,或者是 '\u0000' 和 '\u007f' 之间的字符文本,则使 a 和 b 作为 p 的任意两个框式转换值的结果。结果始终会是 a == b。"

这意味着,如果使用了框式基元(并非 BooleanByte),则仅会缓存或记住一个值区间。对于值的子集,使用 ==!= 会返回正确的值,而对于此子集外的所有其他值,将返回对象地址的比较结果。

示例 1:以下示例对框式基元使用相等运算符。


...
Integer mask0 = 100;
Integer mask1 = 100;
...
if (file0.readWriteAllPerms){
mask0 = 777;
}
if (file1.readWriteAllPerms){
mask1 = 777;
}
...
if (mask0 == mask1){
//assume file0 and file1 have same permissions
...
}
...
Example 1 中的代码会使用框式基元 Integer 尝试比较两个 int 值。如果 mask0mask1 都等于 100,则 mask0 == mask1 将返回 true。但是,如果 mask0mask1 都等于 777,则 mask0 == maske1 现在将返回 false,因为这些值不在这些框式基元的缓存值范围内。
References
[1] EXP03-J. Do not use the equality operators when comparing values of boxed primitives CERT
[2] Java Language Specification Chapter 5. Conversions and Contexts Oracle
[3] Standards Mapping - Common Weakness Enumeration CWE ID 398, CWE ID 754
[4] Standards Mapping - OWASP Application Security Verification Standard 4.0 11.1.7 Business Logic Security Requirements (L2 L3)
[5] Standards Mapping - SANS Top 25 2010 Risky Resource Management - CWE ID 754
desc.structural.java.code_correctness_comparison_of_boxed_primitive_types
Abstract
NaN 进行对比始终是一个错误。
Explanation
如果与 NaN 进行比较,得出的计算结果将始终为 false!= 运算符是个例外,因为 NaN 未经排序,所以始终会得出 true 结果)。

示例 1:以下示例尝试验证变量并非为 NaN


...
if (result == Double.NaN){
//something went wrong
throw new RuntimeException("Something went wrong, NaN found");
}
...


这将尝试验证 result 并非 NaN,但是使用带有 NaN 的运算符 == 将始终得出 false 值,所以此检查将永远不会抛出异常。
References
[1] NUM07-J. Do not attempt comparisons with NaN CERT
[2] Java Language Specification Chapter 4. Types, Values, and Variables Oracle
[3] INJECT-9: Prevent injection of exceptional floating point values Oracle
[4] Standards Mapping - Common Weakness Enumeration CWE ID 486
desc.structural.java.code_correctness_comparison_with_nan
Abstract
类的构造函数会调用可以被覆盖的函数。
Explanation
如果构造函数调用了可覆盖的函数,则在该对象完全初始化之前,攻击者将可以访问 this 引用,进而导致出现漏洞。

示例 1:以下示例调用了可覆盖的方法。


...
class User {
private String username;
private boolean valid;
public User(String username, String password){
this.username = username;
this.valid = validateUser(username, password);
}
public boolean validateUser(String username, String password){
//validate user is real and can authenticate
...
}
public final boolean isValid(){
return valid;
}
}


由于函数 validateUser 和该类并非 final,这意味着它们是可以被覆盖的,对将覆盖此该函数的子类的变量执行初始化会允许避开 validateUser 功能。例如:


...
class Attacker extends User{
public Attacker(String username, String password){
super(username, password);
}
public boolean validateUser(String username, String password){
return true;
}
}
...
class MainClass{
public static void main(String[] args){
User hacker = new Attacker("Evil", "Hacker");
if (hacker.isValid()){
System.out.println("Attack successful!");
}else{
System.out.println("Attack failed");
}
}
}
Example 1 中的代码会输出“Attack successful!”,因为 Attacker 类会覆盖从超类 User 的构造函数调用的 validateUser() 函数,并且 Java 将首先在子类中查找从该构造函数调用的函数。
References
[1] MET05-J. Ensure that constructors do not call overridable methods CERT
[2] EXTEND-5: Limit the extensibility of classes and methods Oracle
[3] OBJECT-4: Prevent constructors from calling methods that can be overridden Oracle
desc.structural.java.code_correctness_constructor_invokes_overridable_function
Abstract
Double-checked locking 是一种不正确的用法,并不能达到预期目标。
Explanation
许多才智卓越的人都试图使用 double-checked locking 方法来提高性能,并为此付出了大量的时间,但是无一成功。

例 1:乍一看,下列代码似乎既能避免不必要的同步又能保证线程的安全性。


if (fitz == null) {
synchronized (this) {
if (fitz == null) {
fitz = new Fitzer();
}
}
}
return fitz;


程序员希望保证仅分配一个 Fitzer() 对象,但又不希望每次调用该代码时都进行一次同步。这就是所谓的 double-checked locking 方法。

令人遗憾的是,它并不起作用,并且可以分配多个 Fitzer() 对象。有关更多详细信息,请参见 The "Double-Checked Locking is Broken" Declaration [1]。
References
[1] D. Bacon et al. The "Double-Checked Locking is Broken" Declaration
[2] LCK10-J. Use a correct form of the double-checked locking idiom CERT
[3] Standards Mapping - Common Weakness Enumeration CWE ID 609
[4] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6
[5] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6
[6] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6
[8] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection
[9] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection
[10] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection
desc.structural.java.code_correctness_double_checked_locking
Abstract
根据对象的类名称确定对象类型会导致意外行为或致使攻击者注入恶意的类。
Explanation
攻击者可以故意复制类名称,使程序执行恶意代码。因此,类名称并非合适的类型标识符,且不应用作向给定对象授予信任的基础。

示例 1:以下代码根据 inputReader 对象的类名称确认是否信任该对象的输入。如果攻击者能够提供一种执行恶意命令的 inputReader 实现方式,则此代码将无法区分该对象是善意的还是恶意的。


if (inputReader.GetType().FullName == "CompanyX.Transaction.Monetary")
{
processTransaction(inputReader);
}
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 486
desc.dataflow.dotnet.code_correctness_erroneous_class_compare
Abstract
根据对象的类名称确定对象类型会导致意外行为或致使攻击者注入恶意的类。
Explanation
攻击者可以故意复制类名称,使程序执行恶意代码。因此,类名称并非合适的类型标识符,且不应用作向给定对象授予信任的基础。

示例 1:以下代码根据 inputReader 对象的类名称确认是否信任该对象的输入。如果攻击者能够提供一种执行恶意命令的 inputReader 实现方式,则此代码将无法区分该对象是善意的还是恶意的。


if (inputReader.getClass().getName().equals("com.example.TrustedClass")) {
input = inputReader.getInput();
...
}
References
[1] OBJ09-J. Compare classes and not class names CERT
[2] Standards Mapping - Common Weakness Enumeration CWE ID 486
desc.dataflow.java.code_correctness_erroneous_class_compare
Abstract
基于对象的类名称确定对象的类型可能会导致意外行为或允许攻击者注入恶意类。
Explanation
攻击者可以故意复制类名称,使程序执行恶意代码。因此,类名称并非合适的类型标识符,且不应用作向给定对象授予信任的基础。

示例 1:以下代码根据 inputReader 对象的类名称确认是否信任该对象的输入。如果攻击者能够提供一种执行恶意命令的 inputReader 实现方式,则此代码将无法区分该对象是善意的还是恶意的。


if (inputReader::class.qualifiedName == "com.example.TrustedClass") {
input = inputReader.getInput()
...
}
References
[1] OBJ09-J. Compare classes and not class names CERT
[2] Standards Mapping - Common Weakness Enumeration CWE ID 486
desc.dataflow.kotlin.code_correctness_erroneous_class_compare
Abstract
finalize() 方法应该调用 super.finalize()
Explanation
The Java Language Specification 中指出,finalize() 方法调用 super.finalize() 是一种非常好的做法 [1]。

例 1:以下方法没有调用 super.finalize()


protected void finalize() {
discardNative();
}
References
[1] J. Gosling, B. Joy, G. Steele, G. Bracha The Java Language Specification, Second Edition Addison-Wesley
[2] MET12-J. Do not use finalizers CERT
[3] Standards Mapping - Common Weakness Enumeration CWE ID 568
desc.structural.java.code_correctness_erroneous_finalize_method
Abstract
字段被错误分配了负值。
Explanation
此字段被标注为 FortifyNonNegative,表示不允许使用负值。
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 20
[2] Standards Mapping - Common Weakness Enumeration Top 25 2021 [4] CWE ID 020
[3] Standards Mapping - Common Weakness Enumeration Top 25 2022 [4] CWE ID 020
[4] Standards Mapping - Common Weakness Enumeration Top 25 2023 [6] CWE ID 020
[5] Standards Mapping - Common Weakness Enumeration Top 25 2024 [12] CWE ID 020
[6] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.1.3 Input Validation Requirements (L1 L2 L3), 5.1.4 Input Validation Requirements (L1 L2 L3)
[7] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 020
desc.structural.java.erroneous_negative_value_field
Abstract
进行字符串对比时,应采用 equals() 方法,而不是==!= 方法。
Explanation
程序采用 ==!= 来比较两个字符串是否相等,其实质比较的是两个对象,而不是字符串的值。因此,若采用这个方法,两个引用将永远不会相等。

例 1:以下分支语句将永远不会被执行。


if (args[0] == STRING_CONSTANT) {
logger.info("miracle");
}


==!= 标记符被用来比较相同对象中包含的字符串时,它们只会按照预期的那样运行。要出现这种情况,最常用的方法就是将字符串内置,这样一来,就可以将字符串添加到一个由 String 类维护的对象池中。一旦字符串内置,在使用该字符串时,都会采用相同的对象,相等运算符也会按照预期的那样执行。所有字符串文字和带值的字符串常量都会自动内置。其他字符串可以通过调用 String.intern() 来手动内置,并会返回一个规范的当前字符串实例,必要时也会创建一个实例。
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 597
desc.structural.java.code_correctness_erroneous_string_compare