DISA STIG version 5 IDs mapped to Klocwork Java checkers

SV.DOS.TMPFILEDEL   Leaving temporary file for lifetime of JVM

SV.DOS.TMPFILEEXIT   Leaving temporary file

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SPRING.AUTHC.ABSENT   No configuration for a critical resource

SPRING.AUTHC.MISSING   Missing authentication for critical function

SPRING.AUTHZ.ABSENT   No configuration for protected resource

SPRING.AUTHZ.MISSING   Missing Authorization

SV.AUTH.BYPASS.MIGHT   Incorrect Authentication

SV.AUTH.BYPASS.MUST   Incorrect Authentication

SV.EXPOSE.FIELD   Static field may be changed by malicious code

SV.EXPOSE.FIN   Method finalize() should have protected access modifier, not public

SV.EXPOSE.IFIELD   Instance field should be made final

SV.EXPOSE.MUTABLEFIELD   Static mutable field can be accessed by malicious code

SV.EXPOSE.RET   Internal representation may be exposed

SV.EXPOSE.STORE   Method stores reference to mutable object

SPRING.AUTHC.ABSENT   No configuration for a critical resource

SPRING.AUTHC.MISSING   Missing authentication for critical function

SPRING.AUTHZ.ABSENT   No configuration for protected resource

SPRING.AUTHZ.MISSING   Missing Authorization

SV.CLEXT.POLICY   Class extends 'java.security.Policy'

SV.PRIVILEGE.MISSING   Method invoked should not be inside doPrivileged block

SV.USE.POLICY   Direct use methods of Policy

SV.LOG_FORGING   Log Forging

SV.LOG_FORGING   Log Forging

SV.EMAIL   Unchecked e-mail

SV.SSRF.URI   URI based on invalidated user input.

UMC.SYSERR   Debug print using System.err method calls is unwanted

UMC.SYSOUT   Debug print using System.out method calls is unwanted

SV.PASSWD.HC.EMPTY   Empty Password

SV.PASSWD.HC.MINLEN   Minimum 15 character length Hardcoded Password

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.PASSWD.HC   Hardcoded Password

SV.PASSWD.HC.EMPTY   Empty Password

SV.PASSWD.PLAIN.HC   Plain-text Password

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.PASSWD.PLAIN   Plain-text Password

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.PASSWD.HC   Hardcoded Password

SV.PASSWD.HC.EMPTY   Empty Password

SV.PASSWD.PLAIN   Plain-text Password

SV.PASSWD.PLAIN.HC   Plain-text Password

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.CERT.INVALID   Certificate must be validated by constructing certification path.

SV.ECV.TRUSTMANAGER   Unsafe implementation of the interface X509TrustManager.

SV.PERMS.HOME   File created in user home directory, without setting permissions

SV.PERMS.WIDE   Too wide permissions

SV.PASSWD.PLAIN   Plain-text Password

JAVA.SV.EMAIL.HOST   Sending e-mails to Host without validation.

SV.AUTH.HASH.MIGHT   Use of weak cryptographic algorithm

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.ECV   Empty certificate validation

SV.ECV.TRUSTMANAGER   Unsafe implementation of the interface X509TrustManager.

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.KEYS.AES   Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.DH   Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.DSA   Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.EC   Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.RSA   Insufficient key length in Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.XSS.COOKIE   Sensitive cookie without setHttpOnly flag

SV.XSS.COOKIE.SECURE   Sensitive cookie without Secure protocol

JD.NEXT   Possible 'NoSuchElementException'

JD.SYNC.IN   Inconsistent synchronization

SV.SHARED.VAR   Unsynchronized access to static variable from servlet

SV.STRUTS.STATIC   Struts Forms: static fields

SV.UMC.THREADS   Bad practices: use of thread management

RLK.NIO   NIO object is not closed on exit

RLK.SOCK   Socket is not closed on exit

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.IL.SESSION   Logging of session id

SV.IL.SESSION.CLIENT   HttpServletRequest.getRequestedSessionId method should not be used.

SV.SESSION.FIXATION.COOKIE   Cookies should not be vulnerable to session fixation

SV.SPRING.FIXATION   Session fixation protection is disabled

SV.XSS.COOKIE   Sensitive cookie without setHttpOnly flag

SV.XSS.COOKIE.SECURE   Sensitive cookie without Secure protocol

SV.IL.SESSION   Logging of session id

SV.IL.SESSION.CLIENT   HttpServletRequest.getRequestedSessionId method should not be used.

SV.SESSION.FIXATION.COOKIE   Cookies should not be vulnerable to session fixation

SV.SPRING.FIXATION   Session fixation protection is disabled

SV.XSS.COOKIE   Sensitive cookie without setHttpOnly flag

SV.XSS.COOKIE.SECURE   Sensitive cookie without Secure protocol

SV.RANDOM   Use of insecure Random number generator

ANDROID.RLK.SQLOBJ   Sql object is not closed on exit

RLK.HIBERNATE   Hibernate object is not closed on exit

RLK.JNDI   JNDI context is not closed on exit

RLK.JPA   {3} object is not closed on exit.

RLK.SQLCON   Sql connection is not closed on exit

RLK.SQLOBJ   Sql object is not closed on exit

SV.DOS.TMPFILEDEL   Leaving temporary file for lifetime of JVM

SV.DOS.TMPFILEEXIT   Leaving temporary file

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.CLEXT.POLICY   Class extends 'java.security.Policy'

SV.USE.POLICY   Direct use methods of Policy

SV.DOS.ARRINDEX   Tainted index used for array access

SV.DOS.ARRSIZE   Tainted size used for array allocation

SV.TAINT_NATIVE   Tainted data goes to native code

SV.TMPFILE   Temporary file path tampering

SV.UMC.EXIT   The System.exit() and Runtime.exit() method calls should not be used in servlets code

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.PASSWD.HC   Hardcoded Password

SV.PASSWD.HC.EMPTY   Empty Password

SV.PASSWD.PLAIN   Plain-text Password

SV.PASSWD.PLAIN.HC   Plain-text Password

SV.RANDOM   Use of insecure Random number generator

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.SERIAL.NOFINAL   Methods readObject() and writeObject() in serializable classes should be final

SV.SERIAL.NOREAD   Method readObject() should be defined for a serializable class

SV.SERIAL.NOWRITE   Method writeObject() should be defined for a serializable class

SV.SERIAL.SIG   Methods readObject() and writeObject() in serializable classes should have correct signature

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.IL.DEV   Design information leakage

SV.IL.FILE   File Name Leaking

SV.STRBUF.CLEAN   String buffer not cleaned

SV.STRUTS.NOTRESET   Struts Forms: inconsistent reset

ANDROID.LIFECYCLE.SV.GETEXTRA   Unvalidated external data

SV.HTTP_SPLIT   Http Response Splitting

SV.XSS.COOKIE   Sensitive cookie without setHttpOnly flag

SV.XSS.DB   Cross Site Scripting (Stored XSS)

SV.XSS.REF   Cross Site Scripting (Reflected XSS)

SV.CSRF.GET   CSRF Token in GET request

SV.CSRF.ORIGIN   Request handler without an origin check

SV.CSRF.TOKEN   State changing request handler without a CSRF check

SV.CLASSDEF.INJ   Runtime Class Definition Injection

SV.CLASSLOADER.INJ   Class Loader URL Injection

SV.CLEXT.CLLOADER   Class extends 'java.lang.ClassLoader'

SV.EMAIL   Unchecked e-mail

SV.EXEC   Process Injection

SV.EXEC.DIR   Process Injection. Working Directory

SV.EXEC.ENV   Process Injection. Environment Variables

SV.EXEC.LOCAL   Process Injection. Local Arguments

SV.PATH   Path and file name injection

SV.PATH.INJ   File injection

SV.SCRIPT   Script Execution

SV.SERIAL.INON   Interface extends 'Serializable'

SV.SERIAL.NON   Class implements 'Serializable'

SV.SERIAL.NOREAD   Method readObject() should be defined for a serializable class

SV.SERIAL.NOWRITE   Method writeObject() should be defined for a serializable class

SV.SERIAL.SIG   Methods readObject() and writeObject() in serializable classes should have correct signature

ANDROID.LIFECYCLE.SV.FRAGMENTINJ   Unvalidated fragment class name

ANDROID.LIFECYCLE.SV.GETEXTRA   Unvalidated external data

CMP.CLASS   Comparing by classname

SV.CLASSDEF.INJ   Runtime Class Definition Injection

SV.CLASSLOADER.INJ   Class Loader URL Injection

SV.DATA.BOUND   Untrusted Data leaks into trusted storage

SV.DATA.DB   Data injection

SV.DOS.ARRINDEX   Tainted index used for array access

SV.DOS.ARRSIZE   Tainted size used for array allocation

SV.EMAIL   Unchecked e-mail

SV.EXEC   Process Injection

SV.EXEC.DIR   Process Injection. Working Directory

SV.EXEC.ENV   Process Injection. Environment Variables

SV.HTTP_SPLIT   Http Response Splitting

SV.INT_OVF   Tainted data may lead to Integer Overflow

SV.LDAP   Unvalidated user input is used as LDAP filter

SV.PATH   Path and file name injection

SV.PATH.INJ   File injection

SV.SCRIPT   Script Execution

SV.SQL   Sql Injection

SV.SSRF.URI   URI based on invalidated user input.

SV.STRUTS.NOTVALID   Struts Forms: inconsistent validate

SV.STRUTS.VALIDMET   Struts Forms: validate method

SV.TAINT   Tainted data

SV.TAINT_NATIVE   Tainted data goes to native code

SV.TMPFILE   Temporary file path tampering

SV.XPATH   Unvalidated user input is used as an XPath expression

SV.XSS.REF   Cross Site Scripting (Reflected XSS)

SV.SQL   Sql Injection

SV.SQL.DBSOURCE   Unchecked information from the database is used in SQL statements

SV.XPATH   Unvalidated user input is used as an XPath expression

SV.XXE.DBF   Possibility for XML External Entity attack

SV.XXE.SF   Possibility for XML External Entity attack

SV.XXE.SPF   Possibility for XML External Entity attack

SV.XXE.TF   Possibility for XML External Entity attack

SV.XXE.XIF   Possibility for XML External Entity attack

SV.XXE.XRF   Possibility for XML External Entity attack

ANDROID.LIFECYCLE.SV.FRAGMENTINJ   Unvalidated fragment class name

ANDROID.LIFECYCLE.SV.GETEXTRA   Unvalidated external data

CMP.CLASS   Comparing by classname

SV.CLASSDEF.INJ   Runtime Class Definition Injection

SV.CLASSLOADER.INJ   Class Loader URL Injection

SV.DATA.BOUND   Untrusted Data leaks into trusted storage

SV.DATA.DB   Data injection

SV.DOS.ARRINDEX   Tainted index used for array access

SV.DOS.ARRSIZE   Tainted size used for array allocation

SV.EMAIL   Unchecked e-mail

SV.EXEC   Process Injection

SV.EXEC.DIR   Process Injection. Working Directory

SV.EXEC.ENV   Process Injection. Environment Variables

SV.HTTP_SPLIT   Http Response Splitting

SV.INT_OVF   Tainted data may lead to Integer Overflow

SV.LDAP   Unvalidated user input is used as LDAP filter

SV.PATH   Path and file name injection

SV.PATH.INJ   File injection

SV.SCRIPT   Script Execution

SV.SQL   Sql Injection

SV.SSRF.URI   URI based on invalidated user input.

SV.STRUTS.NOTVALID   Struts Forms: inconsistent validate

SV.STRUTS.VALIDMET   Struts Forms: validate method

SV.TAINT   Tainted data

SV.TAINT_NATIVE   Tainted data goes to native code

SV.TMPFILE   Temporary file path tampering

SV.XPATH   Unvalidated user input is used as an XPath expression

SV.XSS.REF   Cross Site Scripting (Reflected XSS)

SV.DOS.ARRINDEX   Tainted index used for array access

SV.DOS.ARRSIZE   Tainted size used for array allocation

SV.INT_OVF   Tainted data may lead to Integer Overflow

SV.TAINT_NATIVE   Tainted data goes to native code

JD.INF.AREC   Apparent infinite recursion

JD.LOCK   Lock without unlock

JD.LOCK.NOTIFY   Method 'notify' called with locks held

JD.LOCK.SLEEP   Method 'sleep' called with locks held

JD.LOCK.WAIT   Method 'wait' called with locks held

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.PASSWD.HC   Hardcoded Password

SV.PASSWD.HC.EMPTY   Empty Password

SV.PASSWD.PLAIN   Plain-text Password

SV.PASSWD.PLAIN.HC   Plain-text Password

JD.THREAD.RUN   Explicit call to a 'Thread.run' method

JD.UMC.FINALIZE   Explicit call to method 'Object.finalize'

JD.UMC.RUNFIN   runFinalizersOnExit() is called

MNA.CAP   Method name should start with non-capital letter

MNA.CNS   Method name is same as constructor name but it is not a constructor

MNA.SUS   Suspicious method name

ECC.EMPTY   Empty catch clause

EXC.BROADTHROWS   Method has an overly broad throws declaration

JD.CATCH   Catching runtime exception

JD.UNCAUGHT   Uncaught exception

RI.IGNOREDCALL   The value returned by a method called on immutable object is ignored

RI.IGNOREDNEW   Newly created object is ignored

RR.IGNORED   The returned value is ignored

SV.PASSWD.HC   Hardcoded Password

SV.DOS.ARRINDEX   Tainted index used for array access

SV.DOS.ARRSIZE   Tainted size used for array allocation

SV.TAINT_NATIVE   Tainted data goes to native code

SV.TMPFILE   Temporary file path tampering

SV.UMC.EXIT   The System.exit() and Runtime.exit() method calls should not be used in servlets code

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.