SpotBugs Bug Detector Report
The following document contains the results of SpotBugs
SpotBugs Version is 4.10.4
Threshold is medium
Effort is
Summary
| Classes | Bugs | Errors | Missing Classes |
|---|---|---|---|
| 121 | 117 | 0 | 0 |
Files
waffle.jaas.RolePrincipalTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Object deserialization is used in waffle.jaas.RolePrincipalTest.testIsSerializable() | SECURITY | OBJECT_DESERIALIZATION | 84 | High |
waffle.jaas.UserPrincipalTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Object deserialization is used in waffle.jaas.UserPrincipalTest.testIsSerializable() | SECURITY | OBJECT_DESERIALIZATION | 84 | High |
waffle.jaas.UsernamePasswordCallbackHandler
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.jaas.UsernamePasswordCallbackHandler.handle(Callback[]) uses instanceof on multiple types to arbitrate logic | STYLE | ITC_INHERITANCE_TYPE_CHECKING | 44 | Medium |
waffle.jaas.WindowsLoginModule
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| waffle.jaas.WindowsLoginModule.initialize(Subject, CallbackHandler, Map, Map) may expose internal representation by storing an externally mutable object into WindowsLoginModule.subject | MALICIOUS_CODE | EI_EXPOSE_REP2 | 77 | Medium |
| Method waffle.jaas.WindowsLoginModule.login() throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 123 | Medium |
| Method waffle.jaas.WindowsLoginModule.login() throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 127 | Medium |
| Method waffle.jaas.WindowsLoginModule.login() throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 135 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 122 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 125 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 134 | Medium |
waffle.jaas.WindowsLoginModuleTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.jaas.WindowsLoginModuleTest$1 at new waffle.jaas.WindowsLoginModuleTest$1(WindowsLoginModuleTest) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 221 | Medium |
waffle.jaas.WindowsLoginModuleTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.jaas.WindowsLoginModuleTest$2 at new waffle.jaas.WindowsLoginModuleTest$2(WindowsLoginModuleTest) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 247 | Medium |
waffle.servlet.CorsAwareNegotiateSecurityFilterTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.CorsAwareNegotiateSecurityFilterTest.doFilterTestCorsPreflightRequest() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 57 | Medium |
| Method waffle.servlet.CorsAwareNegotiateSecurityFilterTest.doFilterTestCorsPreflightRequest() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 72 | Medium |
waffle.servlet.CorsAwareNegotiateSecurityFilterTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 61 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 59 | Medium |
waffle.servlet.CorsAwareNegotiateSecurityFilterTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.CorsAwareNegotiateSecurityFilterTest$2 at new waffle.servlet.CorsAwareNegotiateSecurityFilterTest$2(CorsAwareNegotiateSecurityFilterTest) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 76 | Medium |
waffle.servlet.NegotiateSecurityFilter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.NegotiateSecurityFilter.init(FilterConfig) is excessively complex, with a cyclomatic complexity of 68 | STYLE | CC_CYCLOMATIC_COMPLEXITY | 307 | Medium |
| Method waffle.servlet.NegotiateSecurityFilter.init(FilterConfig) accesses list or array with constant index | CORRECTNESS | CLI_CONSTANT_LIST_INDEX | 401 | Medium |
| Unconstrained method waffle.servlet.NegotiateSecurityFilter.sendUnauthorized(HttpServletResponse, boolean) converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS | 473 | High |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 168 | Medium |
waffle.servlet.NegotiateSecurityFilterTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.NegotiateSecurityFilterTest.testCorsAndBearerAuthorizationI_init(FilterConfig) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 98 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testCorsAndBearerAuthorizationI_init(FilterConfig) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 99 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testCorsAndBearerAuthorizationI_init(FilterConfig) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 69 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testCorsAndBearerAuthorizationI_init(FilterConfig) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 105 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testExcludeCorsAndOAUTHBearerAuthorization_doFilter(HttpServletRequest, HttpServletResponse, FilterChain, FilterConfig) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 135 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testExcludeCorsAndOAUTHBearerAuthorization_doFilter(HttpServletRequest, HttpServletResponse, FilterChain, FilterConfig) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 166 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$4
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.servlet.NegotiateSecurityFilterTest$4(NegotiateSecurityFilterTest, FilterConfig, HttpServletRequest) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 156 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 157 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$5
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.NegotiateSecurityFilterTest$5 at new waffle.servlet.NegotiateSecurityFilterTest$5(NegotiateSecurityFilterTest, FilterChain, HttpServletRequest, HttpServletResponse) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 168 | Medium |
waffle.servlet.WaffleInfoServlet
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Unconstrained method waffle.servlet.WaffleInfoServlet.getWaffleInfoResponse(HttpServletRequest, HttpServletResponse) converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS | 95 | High |
| Method waffle.servlet.WaffleInfoServlet.getWaffleInfoResponse(HttpServletRequest, HttpServletResponse) throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 95 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 94 | Medium |
waffle.servlet.WindowsPrincipal
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Class waffle.servlet.WindowsPrincipal defines List based fields but uses them like Sets | PERFORMANCE | DLC_DUBIOUS_LIST_COLLECTION | 221 | Medium |
| waffle.servlet.WindowsPrincipal.getGroups() may expose internal representation by returning WindowsPrincipal.groups | MALICIOUS_CODE | EI_EXPOSE_REP | 139 | Medium |
| Class waffle.servlet.WindowsPrincipal 'overloads' a method with both instance and static versions | STYLE | MOM_MISLEADING_OVERLOAD_MODEL | 139 | Medium |
| Method waffle.servlet.WindowsPrincipal.getGroups(IWindowsAccount[]) does not presize the allocation of a collection | PERFORMANCE | PSC_PRESIZE_COLLECTIONS | 110 | Medium |
waffle.servlet.spi.BasicSecurityFilterProviderTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.spi.BasicSecurityFilterProviderTest.testSendUnauthorized() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 109 | Medium |
| Method waffle.servlet.spi.BasicSecurityFilterProviderTest.testSendUnauthorizedWithCustomRealm() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 125 | Medium |
| Method waffle.servlet.spi.BasicSecurityFilterProviderTest.testSendUnauthorizedWithRealmViaInit() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 157 | Medium |
| Method waffle.servlet.spi.BasicSecurityFilterProviderTest.testSendUnauthorizedWithRealmViaInit() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 164 | Medium |
waffle.servlet.spi.NegotiateSecurityFilterProvider
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| waffle.servlet.spi.NegotiateSecurityFilterProvider.getProtocols() may expose internal representation by returning NegotiateSecurityFilterProvider.protocolsList | MALICIOUS_CODE | EI_EXPOSE_REP | 71 | Medium |
| waffle.servlet.spi.NegotiateSecurityFilterProvider.setProtocols(List) may expose internal representation by storing an externally mutable object into NegotiateSecurityFilterProvider.protocolsList | MALICIOUS_CODE | EI_EXPOSE_REP2 | 81 | Medium |
waffle.servlet.spi.NegotiateSecurityFilterProviderTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.spi.NegotiateSecurityFilterProviderTest.testSendUnauthorizedWithCustomProtocols() builds a list from one element using Arrays.asList rather than Collections.singletonList | CORRECTNESS | LUI_USE_SINGLETON_LIST | 118 | Medium |
| Method waffle.servlet.spi.NegotiateSecurityFilterProviderTest.testSetProtocols() builds a list from one element using Arrays.asList rather than Collections.singletonList | CORRECTNESS | LUI_USE_SINGLETON_LIST | 63 | Medium |
| Method waffle.servlet.spi.NegotiateSecurityFilterProviderTest.testSendUnauthorized() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 103 | Medium |
| Method waffle.servlet.spi.NegotiateSecurityFilterProviderTest.testSendUnauthorizedWithCustomProtocols() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 120 | Medium |
waffle.servlet.spi.SecurityFilterProviderCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.spi.SecurityFilterProviderCollection at new waffle.servlet.spi.SecurityFilterProviderCollection(String[], IWindowsAuthProvider) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 72 | Medium |
| Unconstrained method new waffle.servlet.spi.SecurityFilterProviderCollection(String[], IWindowsAuthProvider) converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS | 72 | High |
| Method waffle.servlet.spi.SecurityFilterProviderCollection.doFilter(HttpServletRequest, HttpServletResponse) appears to call the same method on the same object redundantly | PERFORMANCE | PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS | 139 | Medium |
| Method new waffle.servlet.spi.SecurityFilterProviderCollection(SecurityFilterProvider[]) does not presize the allocation of a collection | PERFORMANCE | PSC_PRESIZE_COLLECTIONS | 47 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 76 | Medium |
waffle.servlet.spi.SecurityFilterProviderCollectionTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.spi.SecurityFilterProviderCollectionTest.lambda$testConstructorWithInvalidClassName$0(String[]) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 134 | Medium |
| Method waffle.servlet.spi.SecurityFilterProviderCollectionTest.testSendUnauthorized() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 89 | Medium |
waffle.util.AuthorizationHeader
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.util.AuthorizationHeader.getTokenBytes() throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 106 | Medium |
| Method waffle.util.AuthorizationHeader.isBearerAuthorizationHeader() makes literal string comparisons passing the literal as an argument | STYLE | LSC_LITERAL_STRING_COMPARISON | 174 | High |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 105 | Medium |
| Method waffle.util.AuthorizationHeader.isBearerAuthorizationHeader() compares string without case after enforcing a case | PERFORMANCE | SPP_USELESS_CASING | 174 | Medium |
waffle.util.CorsPreFlightCheck
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.util.CorsPreFlightCheck.isPreflight(HttpServletRequest) makes literal string comparisons passing the literal as an argument | STYLE | LSC_LITERAL_STRING_COMPARISON | 57 | High |
| Method waffle.util.CorsPreFlightCheck.isPreflight(HttpServletRequest) makes literal string comparisons passing the literal as an argument | STYLE | LSC_LITERAL_STRING_COMPARISON | 67 | High |
waffle.util.CorsPreFlightCheckTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.util.CorsPreFlightCheckTest.testCorsFilterPreFlightAttributeReturnsTrue() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 192 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testCorsMethodPreflightHeadersPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 115 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testCorsMethodPreflightHeadersPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 126 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testExpectedCorsPreflightHeadersPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 45 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testExpectedCorsPreflightHeadersPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 60 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNoCorsHeadersPreflightHeaderPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 143 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNoCorsHeadersPreflightHeaderPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 159 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNoCorsPreflightOriginPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 79 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNoCorsPreflightOriginPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 95 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNonOptionsMethodReturnsFalse() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 178 | Medium |
waffle.util.CorsPreFlightCheckTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 49 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 47 | Medium |
waffle.util.CorsPreFlightCheckTest$10
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 194 | Medium |
waffle.util.CorsPreFlightCheckTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 64 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 62 | Medium |
waffle.util.CorsPreFlightCheckTest$3
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 83 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 81 | Medium |
waffle.util.CorsPreFlightCheckTest$4
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 99 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 97 | Medium |
waffle.util.CorsPreFlightCheckTest$5
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 119 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 117 | Medium |
waffle.util.CorsPreFlightCheckTest$6
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 130 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 128 | Medium |
waffle.util.CorsPreFlightCheckTest$7
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 148 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 145 | Medium |
waffle.util.CorsPreFlightCheckTest$8
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 164 | Medium |
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 161 | Medium |
waffle.util.CorsPreFlightCheckTest$9
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of jakarta.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 180 | Medium |
waffle.util.NtlmMessage
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Hard coded cryptographic key found | SECURITY | HARD_CODE_KEY | 16-57 | Medium |
waffle.util.WaffleInfo
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| This use of org/slf4j/Logger.error(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages | SECURITY | CRLF_INJECTION_LOGS | 325 | Medium |
| Format should be constant. Use placeholder to reduce the needless cost of parameter construction. see http://www.slf4j.org/faq.html#logging_performance | CORRECTNESS | SLF4J_FORMAT_SHOULD_BE_CONST | 346 | High |
| Format should be constant. Use placeholder to reduce the needless cost of parameter construction. see http://www.slf4j.org/faq.html#logging_performance | CORRECTNESS | SLF4J_FORMAT_SHOULD_BE_CONST | 349 | High |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 350 | Medium |
waffle.util.cache.Cache
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Unconstrained method waffle.util.cache.Cache.newCache(int) converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS | 67 | High |
waffle.windows.auth.WindowsAccountValueTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| JUnit test method waffle.windows.auth.WindowsAccountValueTest.testNotEqualsNull() passes null to Assert.assertNotEquals | CORRECTNESS | UTAO_JUNIT_ASSERTION_ODDITIES_USE_ASSERT_NOT_NULL | 115 | Medium |
waffle.windows.auth.WindowsAccountValueTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of IWindowsAccount.getDomain() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 41 | Medium |
| Return value of IWindowsAccount.getFqn() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 37 | Medium |
| Return value of IWindowsAccount.getName() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 39 | Medium |
| Return value of IWindowsAccount.getSidString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 35 | Medium |
waffle.windows.auth.WindowsAccountValueTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of IWindowsAccount.getDomain() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 93 | Medium |
| Return value of IWindowsAccount.getFqn() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 89 | Medium |
| Return value of IWindowsAccount.getName() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 91 | Medium |
| Return value of IWindowsAccount.getSidString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 87 | Medium |
waffle.windows.auth.impl.WindowsAuthProviderImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.windows.auth.impl.WindowsAuthProviderImpl at new waffle.windows.auth.impl.WindowsAuthProviderImpl() will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 76 | Medium |
| Exception thrown in class waffle.windows.auth.impl.WindowsAuthProviderImpl at new waffle.windows.auth.impl.WindowsAuthProviderImpl(int) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 86 | Medium |
| Constrained method waffle.windows.auth.impl.WindowsAuthProviderImpl.getCurrentComputer() converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CHECKED | 170 | Medium |
| Method waffle.windows.auth.impl.WindowsAuthProviderImpl.getCurrentComputer() calls InetAddress.getLocalHost(), which may be a security risk | CORRECTNESS | MDM_INETADDRESS_GETLOCALHOST | 168 | Medium |
| Method waffle.windows.auth.impl.WindowsAuthProviderImpl.getDomains() does not presize the allocation of a collection | PERFORMANCE | PSC_PRESIZE_COLLECTIONS | 179 | Medium |
waffle.windows.auth.impl.WindowsComputerImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.windows.auth.impl.WindowsComputerImpl.getGroups() does not presize the allocation of a collection | PERFORMANCE | PSC_PRESIZE_COLLECTIONS | 50 | Medium |
waffle.windows.auth.impl.WindowsCredentialsHandleImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| waffle.windows.auth.impl.WindowsCredentialsHandleImpl.getHandle() may expose internal representation by returning WindowsCredentialsHandleImpl.handle | MALICIOUS_CODE | EI_EXPOSE_REP | 102 | Medium |
waffle.windows.auth.impl.WindowsIdentityImpersonationContextImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.windows.auth.impl.WindowsIdentityImpersonationContextImpl at new waffle.windows.auth.impl.WindowsIdentityImpersonationContextImpl(WinNT$HANDLE) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 29 | Medium |
waffle.windows.auth.impl.WindowsIdentityImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new waffle.windows.auth.impl.WindowsIdentityImpl(WinNT$HANDLE) may expose internal representation by storing an externally mutable object into WindowsIdentityImpl.windowsIdentity | MALICIOUS_CODE | EI_EXPOSE_REP2 | 43 | Medium |
waffle.windows.auth.impl.WindowsSecurityContextImpersonationContextImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.windows.auth.impl.WindowsSecurityContextImpersonationContextImpl at new waffle.windows.auth.impl.WindowsSecurityContextImpersonationContextImpl(Sspi$CtxtHandle) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 33 | Medium |
| new waffle.windows.auth.impl.WindowsSecurityContextImpersonationContextImpl(Sspi$CtxtHandle) may expose internal representation by storing an externally mutable object into WindowsSecurityContextImpersonationContextImpl.ctx | MALICIOUS_CODE | EI_EXPOSE_REP2 | 36 | Medium |
waffle.windows.auth.impl.WindowsSecurityContextImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| waffle.windows.auth.impl.WindowsSecurityContextImpl.getHandle() may expose internal representation by returning WindowsSecurityContextImpl.ctx | MALICIOUS_CODE | EI_EXPOSE_REP | 178 | Medium |
| waffle.windows.auth.impl.WindowsSecurityContextImpl.setSecurityContext(Sspi$CtxtHandle) may expose internal representation by storing an externally mutable object into WindowsSecurityContextImpl.ctx | MALICIOUS_CODE | EI_EXPOSE_REP2 | 218 | Medium |
| Class waffle.windows.auth.impl.WindowsSecurityContextImpl 'overloads' a method with both instance and static versions | STYLE | MOM_MISLEADING_OVERLOAD_MODEL | 151-158 | Medium |