SAST Java Rules

Key Java Security Rules

• GIT Leaks

• Missing HTTP Only option in cookie configuration

• GIT Leaks

• Leakage of Information in Logger Message

• Leakage of sensitive data in cookie

• Leakage of sensitive data in exception message

• Leakage of sensitive data to Airbrake

• Leakage of sensitive data to Algolia

• Leakage of Sensitive Data to Bugsnag

• Leakage of Sensitive Data to ClickHouse

• Leakage of Sensitive Data to Datadog

• Leakage of Sensitive Data to ElasticSearch

• Leakage of Sensitive Data to New Relic

• Leakage of Sensitive Data to OpenTelemetry

• Leakage of Sensitive Data to RollBar

• Leakage of Sensitive Data to Sentry

• Leakage of Sensitive Information in Exception Messages

• Leakage of sensitive information in logger message

• Missing authentication for database

• Missing database password detected

• Missing HTTP Only Option in Cookie Configuration

• Missing Optimal Asymmetric Encryption Padding (OAEP)

• Missing or Permissive SSL Hostname Verifier

• Missing Protection against Session Fixation Attacks

• Missing Secure option in cookie configuration

• Missing signature verification of JWT

• Missing SSL host check in SMTP

• Missing Support for Integrity Check

• Missing TLS validation

• Observable Timing Discrepancy

• Permissive Access-Control-Allow-Origin configuration

• Permissive context mode for resources

• Permissive cookie configuration

• Permissive HTTP Only option in cookie configuration

• Permissive Screenshot option set

• Possible CLRF injection detected

• Possible expression language (EL) injection detected

• Possible HTTP Parameter Pollution detected

• Unsanitized external input in SQL query

• Unsanitized use of FileUpload filename

• Unsanitized user input in 'eval' type function

• Unsanitized user input in Access-Control-Allow-Origin

• Unsanitized user input in AWS query

• Unsanitized user input in code generation

• Unsanitized user input in deserialization method

• Unsanitized User Input in File Path

• Unsanitized User Input in File Path

• Unsanitized user input in format string detected

• Unsanitized user input in HTTP request (SSRF)

• Unsanitized user input in HTTP response (XSS)

• Unsanitized user input in LDAP request

• Unsanitized user input in logger message

• Unsanitized User Input in OS Command

• Unsanitized User Input in Output Stream (XSS)

• Unsanitized User input in Redirect

• Unsanitized User Input in Regular Expression

• Unsanitized user input in SQL catalog configuration

• Unsanitized user input in XML External Entity

• Unsanitized User Input in XPath

• Usage of bad hex conversion on digest array

• Usage of CBC (Cipher Block Chaining) Mode with Padding

• Usage of custom Digest class

• Usage of dangerous permissions

• Usage of ECB Cipher Mode

• Usage of External Input in Code Reflection

• Usage of hard-coded database password

• Usage of hard-coded secret

• Usage of insufficient random value

• Usage of naive Socket class to create SSL Socket

• Usage of permissive file permission ('other')

• Usage of small key size with Blowfish encryption

• Usage of Trusted and Untrusted Data inside the same Data Structure

• Usage of vulnerable Apache Commons Collections InvokeTransformer class

• Usage of weak encryption algorithm (DES)

• Usage of Weak Hashing Library on a Password (SHA-1)

• Usage of Weak Hashing library (MD5)