CERT IDs: Java
The following mapping of CERT Java IDs to Klocwork Java checkers is a community-developed mapping.
| Rule | Checker name and description |
|---|---|
| CERT DCL02-J (L3): Do not modify the collection's elements during an enhanced for statement |
JD.UNMOD Modification of unmodifiable collection |
| CERT ENV03-J (L1): Do not grant dangerous combinations of permissions |
SV.CLEXT.POLICY Class extends 'java.security.Policy' |
| CERT ENV06-J (L1): Production code must not contain debugging entry points |
JAVA.DEBUG.ENTRY Production code must not contain debugging entry points |
| CERT ERR01-J (L3): Do not allow exceptions to expose sensitive information |
SV.IL.DEV Design information leakage |
| CERT ERR03-J (L3): Restore prior object state on method failure |
SV.HTTP_SPLIT Http Response Splitting SV.SSRF.URI URI based on invalidated user input. |
| CERT ERR04-J (L3): Do not complete abruptly from a finally block |
JD.FINRET Return inside finally |
| CERT ERR05-J (L3): Do not let checked exceptions escape from a finally block |
JD.UNCAUGHT Uncaught exception |
| CERT ERR07-J (L2): Do not throw RuntimeException, Exception, or Throwable |
EXC.BROADTHROWS Method has an overly broad throws declaration |
| CERT ERR08-J (L1): Do not catch NullPointerException or any of its ancestors |
JD.CATCH Catching runtime exception |
| CERT ERR09-J (L3): Do not allow untrusted code to terminate the JVM |
SV.UMC.EXIT The System.exit() and Runtime.exit() method calls should not be used in servlets code UMC.EXIT The System.exit() method call is unwanted |
| CERT EXP00-J (L2): Do not ignore values returned by methods |
RI.IGNOREDCALL The value returned by a method called on immutable object is ignored RR.IGNORED The returned value is ignored |
| CERT EXP01-J (L3): Do not use a null in a case where an object is required |
NPE.COND Null pointer dereference where null comes from condition NPE.CONST Null pointer dereference where null comes from constant NPE.RET Dereference of a null value which is returned from a method NPE.RET.UTIL Dereference of a null value which is returned from a map or a collection NPE.STAT Null pointer dereference of a return value (statistical) REDUN.EQNULL Suspicious equals() called with expression and null (never true) |
| CERT EXP02-J (L2): Do not use the Object.equals() method to compare two arrays |
JD.EQ.ARR Calling 'equals' on array |
| CERT EXP03-J (L2): Do not use the equality operators when comparing values of boxed primitives |
CMP.OBJ Comparing objects with == |
| CERT FIO01-J (L3): Create files with appropriate access permissions |
SV.PERMS.HOME File created in user home directory, without setting permissions SV.PERMS.WIDE Too wide permissions |
| CERT FIO03-J (L2): Remove temporary files before termination |
SV.DOS.TMPFILEDEL Leaving temporary file for lifetime of JVM SV.DOS.TMPFILEEXIT Leaving temporary file |
| CERT FIO04-J (L3): Release resources when they are no longer needed |
RLK.AWT AWT object is not disposed on exit RLK.FIELD Possible leak of system resource stored in a field RLK.HIBERNATE Hibernate object is not closed on exit RLK.IMAGEIO ImageIO stream is not closed on exit RLK.IN Input stream is not closed on exit RLK.JNDI JNDI context is not closed on exit RLK.JPA {3} object is not closed on exit. RLK.MAIL Java mail object is not closed on exit RLK.MICRO Java Microedition connection is not closed on exit RLK.NIO NIO object is not closed on exit RLK.OUT Output stream is not closed on exit RLK.SOCK Socket is not closed on exit RLK.SQLCON Sql connection is not closed on exit RLK.SQLOBJ Sql object is not closed on exit RLK.SWT SWT object is not disposed on exit RLK.ZIP Zip file is not closed on exit |
| CERT FIO13-J (L3): Do not log sensitive information outside a trust boundary |
SV.IL.SESSION Logging of session id |
| CERT FIO16-J (L3): Canonicalize path names before validating them |
SV.EXEC.PATH Untrusted Search Path SV.PATH Path and file name injection SV.PATH.INJ File injection SV.TMPFILE Temporary file path tampering |
| CERT IDS00-J (L1): Prevent SQL injection |
SV.DATA.DB Data injection SV.SQL Sql Injection SV.SQL.DBSOURCE Unchecked information from the database is used in SQL statements |
| CERT IDS01-J (L1): Normalize strings before validating them |
SV.TAINT Tainted data SV.TAINT_NATIVE Tainted data goes to native code SV.XSS.DB Cross Site Scripting (Stored XSS) SV.XSS.REF Cross Site Scripting (Reflected XSS) |
| CERT IDS03-J (L2): Do not log unsanitized user input |
SV.LOG_FORGING Log Forging |
| CERT IDS07-J (L1): Sanitize untrusted data passed to the Runtime.exec() method |
SV.EXEC Process Injection SV.EXEC.DIR Process Injection. Working Directory SV.EXEC.ENV Process Injection. Environment Variables SV.EXEC.LOCAL Process Injection. Local Arguments SV.EXEC.PATH Untrusted Search Path |
| CERT IDS16-J (L1): Prevent XML Injection |
JAVA.SV.XML.INVALID XML is not validated before being unmarshalled to a Java object |
| CERT IDS17-J (L2): Prevent XML External Entity Attacks |
SV.XXE.DBF Possibility for XML External Entity attack SV.XXE.SF Possibility for XML External Entity attack SV.XXE.SPF Possibility for XML External Entity attack SV.XXE.TF Possibility for XML External Entity attack SV.XXE.XIF Possibility for XML External Entity attack SV.XXE.XRF Possibility for XML External Entity attack |
| CERT JNI00-J (L3): Define wrappers around native methods |
JAVA.NATIVE.PUBLIC Define wrappers around native methods |
| CERT JNI01-J (L1): Safely invoke standard APIs that perform tasks using the immediate caller's class loader instance (loadLibrary) |
SV.LOADLIB.INJ Untrusted call to 'loadLibrary' method |
| CERT LCK05-J (L3): Synchronize access to static fields that can be modified by untrusted code |
SV.SHARED.VAR Unsynchronized access to static variable from servlet |
| CERT LCK07-J (L3): Avoid deadlock by requesting and releasing locks in the same order |
JD.LOCK Lock without unlock |
| CERT LCK09-J (L3): Do not perform operations that can block while holding a lock |
JD.LOCK.NOTIFY Method 'notify' called with locks held JD.LOCK.SLEEP Method 'sleep' called with locks held JD.LOCK.WAIT Method 'wait' called with locks held |
| CERT LCK10-J (L3): Use a correct form of the double-checked locking idiom |
JD.SYNC.DCL Double-checked locking |
| CERT MET01-J (L2): Never use assertions to validate method arguments |
JAVA.ASSERT.ARG Never use assertions to validate method arguments |
| CERT MET09-J (L3): Classes that define an equals() method must also define a hashCode() method |
EHC.EQ Class defines hashCode() but does not define equals() EHC.HASH Class defines equals() but does not define hashCode() |
| CERT MET12-J (L2): Do not use finalizers |
FIN.EMPTY Empty finalize() method should be removed FIN.NOSUPER Implementation of the finalize() method should call super.finalize() JD.UMC.FINALIZE Explicit call to method 'Object.finalize' JD.UMC.RUNFIN runFinalizersOnExit() is called SV.EXPOSE.FIN Method finalize() should have protected access modifier, not public |
| CERT MSC00-J (L2): Use SSLSocket rather than Socket for secure data exchange |
SV.WEAK.TLS Weak SSL/TLS protocols should not be used. |
| CERT MSC01-J (L3): Do not use an empty infinite loop |
JAVA.INF.LOOP.EMPTY Do not use an empty infinite loop |
| CERT MSC02-J (L1): Generate strong random numbers |
SV.RANDOM Use of insecure Random number generator |
| CERT MSC03-J (L1): Never hard code sensitive information |
SV.PASSWD.HC Hardcoded Password SV.PASSWD.HC.EMPTY Empty Password SV.PASSWD.PLAIN Plain-text Password SV.PASSWD.PLAIN.HC Plain-text Password SV.SENSITIVE.DATA Unencrypted sensitive data is written SV.SENSITIVE.OBJ Object with unencrypted sensitive data is stored |
| CERT MSC05-J (L3): Do not exhaust heap space |
JD.INF.ALLOC Allocation within infinite loop SV.DOS.ARRSIZE Tainted size used for array allocation SV.INT_OVF Tainted data may lead to Integer Overflow |
| CERT MSC06-J (L3): Do not modify the underlying collection when an iteration is in progress |
JD.CONCUR Possible ConcurrentModificationException |
| CERT MSC11-J (L2): Do not let session information leak within a servlet |
SV.IL.SESSION Logging of session id SV.IL.SESSION.CLIENT HttpServletRequest.getRequestedSessionId method should not be used. SV.SESSION.FIXATION.COOKIE Cookies should not be vulnerable to session fixation SV.SPRING.FIXATION Session fixation protection is disabled |
| CERT NUM00-J (L3): Detect or prevent integer overflow |
SV.INT_OVF Tainted data may lead to Integer Overflow |
| CERT NUM07-J (L3): Do not attempt comparisons with NaN |
JAVA.COMPARE.NAN Do not attempt comparisons with NaN |
| CERT NUM09-J (L2): Do not use floating-point variables as loop counters |
JAVA.LOOP.CTR.FLOAT Do not use floating-point variables as loop counters |
| CERT NUM10-J (L2): Do not construct BigDecimal objects from floating-point literals |
JAVA.BIGDEC.FLOAT Do not construct BigDecimal objects from floating-point literals |
| CERT OBJ01-J (L1): Limit accessibility of fields |
SV.EXPOSE.FIELD Static field may be changed by malicious code SV.EXPOSE.IFIELD Instance field should be made final SV.EXPOSE.MUTABLEFIELD Static mutable field can be accessed by malicious code SV.STRUTS.PRIVATE Struts Forms: non-private fields SV.STRUTS.STATIC Struts Forms: static fields |
| CERT OBJ04-J (L2): Provide mutable classes with copy functionality to safely allow passing instances to untrusted code |
SV.EXPOSE.RET Internal representation may be exposed SV.EXPOSE.STORE Method stores reference to mutable object |
| CERT OBJ05-J (L1): Do not return references to private mutable class members |
SV.EXPOSE.RET Internal representation may be exposed SV.EXPOSE.STORE Method stores reference to mutable object |
| CERT OBJ09-J (L2): Compare classes and not class names |
CMP.CLASS Comparing by classname |
| CERT OBJ10-J (L2): Do not use public static nonfinal fields |
SV.EXPOSE.FIELD Static field may be changed by malicious code SV.STRUTS.STATIC Struts Forms: static fields |
| CERT OBJ11-J (L1): Be wary of letting constructors throw exceptions |
JAVA.CTOR.EXCEPT Be wary of letting constructors throw exceptions JAVA.FINAL.STATIC.VAR Use of nonfinal static variable |
| CERT SEC00-J (L2): Do not allow privileged blocks to leak sensitive information across a trust boundary |
SV.PRIVILEGE.MISSING Method invoked should not be inside doPrivileged block |
| CERT SEC03-J (L1): Do not load trusted classes after allowing untrusted code to load arbitrary classes |
SV.CLASSLOADER.INJ Class Loader URL Injection SV.CLEXT.CLLOADER Class extends 'java.lang.ClassLoader' SV.CLLOADER Direct use of Classloader |
| CERT SER01-J (L1): Do not deviate from the proper signatures of serialization methods |
SV.SERIAL.SIG Methods readObject() and writeObject() in serializable classes should have correct signature |
| CERT SER03-J (L2): Do not serialize unencrypted sensitive data |
SV.SERIAL.NOFINAL Methods readObject() and writeObject() in serializable classes should be final SV.SERIAL.NOWRITE Method writeObject() should be defined for a serializable class |
| CERT SER05-J (L1): Do not serialize instances of inner classes |
JAVA.SERIALIZE.INNER Do not serialize instances of inner classes |
| CERT SER06-J (L3): Make defensive copies of private mutable components during deserialization |
SV.SERIAL.NOFINAL Methods readObject() and writeObject() in serializable classes should be final SV.SERIAL.NOREAD Method readObject() should be defined for a serializable class |
| CERT SER09-J (L3): Do not invoke overridable methods from the readObject() method |
SV.SERIAL.OVERRIDE Do not invoke overridable methods from the readObject() method |
| CERT SER12-J (L2): Prevent deserialization of untrusted data |
SV.SERIAL.NOFINAL Methods readObject() and writeObject() in serializable classes should be final SV.SERIAL.NOREAD Method readObject() should be defined for a serializable class |
| CERT THI00-J (L3): Do not invoke Thread.run() |
JD.THREAD.RUN Explicit call to a 'Thread.run' method |
| CERT THI01-J (L3): Do not invoke ThreadGroup methods |
JAVA.THREADGROUP Do not invoke ThreadGroup methods |
| CERT THI03-J (L3): Always invoke wait() and await() methods inside a loop |
JAVA.WAIT.IN.LOOP Always invoke wait() and await() methods inside a loop |
| CERT VNA00-J (L2): Ensure visibility when accessing shared primitive variables |
SV.SHARED.VAR Unsynchronized access to static variable from servlet |
| CERT VNA01-J (L3): Ensure visibility of shared references to immutable objects |
SV.SHARED.VAR Unsynchronized access to static variable from servlet |
| CERT VNA02-J (L2): Ensure that compound operations on shared variables are atomic |
SV.SHARED.VAR Unsynchronized access to static variable from servlet |