SpotBugs Bug Detector Report
The following document contains the results of SpotBugs
SpotBugs Version is 4.10.4
Threshold is medium
Effort is
Summary
| Classes | Bugs | Errors | Missing Classes |
|---|---|---|---|
| 188 | 320 | 0 | 0 |
Files
waffle.jaas.RolePrincipalTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Object deserialization is used in waffle.jaas.RolePrincipalTest.testIsSerializable() | SECURITY | OBJECT_DESERIALIZATION | 84 | High |
waffle.jaas.UserPrincipalTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Object deserialization is used in waffle.jaas.UserPrincipalTest.testIsSerializable() | SECURITY | OBJECT_DESERIALIZATION | 84 | High |
waffle.jaas.UsernamePasswordCallbackHandler
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.jaas.UsernamePasswordCallbackHandler.handle(Callback[]) uses instanceof on multiple types to arbitrate logic | STYLE | ITC_INHERITANCE_TYPE_CHECKING | 44 | Medium |
waffle.jaas.WindowsLoginModule
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| waffle.jaas.WindowsLoginModule.initialize(Subject, CallbackHandler, Map, Map) may expose internal representation by storing an externally mutable object into WindowsLoginModule.subject | MALICIOUS_CODE | EI_EXPOSE_REP2 | 77 | Medium |
| Method waffle.jaas.WindowsLoginModule.login() throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 123 | Medium |
| Method waffle.jaas.WindowsLoginModule.login() throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 127 | Medium |
| Method waffle.jaas.WindowsLoginModule.login() throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 135 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 122 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 125 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 134 | Medium |
waffle.jaas.WindowsLoginModuleTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Hard coded password found | SECURITY | HARD_CODE_PASSWORD | 517 | High |
| Hard coded password found | SECURITY | HARD_CODE_PASSWORD | 699 | High |
| Hard coded password found | SECURITY | HARD_CODE_PASSWORD | 415 | High |
| Hard coded password found | SECURITY | HARD_CODE_PASSWORD | 580 | High |
| Hard coded password found | SECURITY | HARD_CODE_PASSWORD | 464 | High |
| Hard coded password found | SECURITY | HARD_CODE_PASSWORD | 639 | High |
| Hard coded password found | SECURITY | HARD_CODE_PASSWORD | 371 | High |
| Method waffle.jaas.WindowsLoginModuleTest.lambda$login_bothPrincipalFormat$0(Callback[]) uses instanceof on multiple types to arbitrate logic | STYLE | ITC_INHERITANCE_TYPE_CHECKING | 514 | Medium |
| Method waffle.jaas.WindowsLoginModuleTest.lambda$login_bothRoleFormat$0(Callback[]) uses instanceof on multiple types to arbitrate logic | STYLE | ITC_INHERITANCE_TYPE_CHECKING | 696 | Medium |
| Method waffle.jaas.WindowsLoginModuleTest.lambda$login_guestDisabledThrows$0(Callback[]) uses instanceof on multiple types to arbitrate logic | STYLE | ITC_INHERITANCE_TYPE_CHECKING | 412 | Medium |
| Method waffle.jaas.WindowsLoginModuleTest.lambda$login_nonePrincipalFormat$0(Callback[]) uses instanceof on multiple types to arbitrate logic | STYLE | ITC_INHERITANCE_TYPE_CHECKING | 577 | Medium |
| Method waffle.jaas.WindowsLoginModuleTest.lambda$login_sidPrincipalFormat$0(Callback[]) uses instanceof on multiple types to arbitrate logic | STYLE | ITC_INHERITANCE_TYPE_CHECKING | 461 | Medium |
| Method waffle.jaas.WindowsLoginModuleTest.lambda$login_sidRoleFormat$0(Callback[]) uses instanceof on multiple types to arbitrate logic | STYLE | ITC_INHERITANCE_TYPE_CHECKING | 636 | Medium |
| Method waffle.jaas.WindowsLoginModuleTest.lambda$login_successWithMockedAuth$0(Callback[]) uses instanceof on multiple types to arbitrate logic | STYLE | ITC_INHERITANCE_TYPE_CHECKING | 368 | Medium |
waffle.jaas.WindowsLoginModuleTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.jaas.WindowsLoginModuleTest$1 at new waffle.jaas.WindowsLoginModuleTest$1(WindowsLoginModuleTest) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 224 | Medium |
waffle.jaas.WindowsLoginModuleTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.jaas.WindowsLoginModuleTest$2 at new waffle.jaas.WindowsLoginModuleTest$2(WindowsLoginModuleTest) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 250 | Medium |
waffle.jaas.WindowsLoginModuleTest$3
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.jaas.WindowsLoginModuleTest$3(WindowsLoginModuleTest, IWindowsAuthProvider, IWindowsIdentity, IWindowsAccount) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 345 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getFqn() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 349 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getSidString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 352 | Medium |
waffle.jaas.WindowsLoginModuleTest$4
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.jaas.WindowsLoginModuleTest$4(WindowsLoginModuleTest, IWindowsAuthProvider, IWindowsIdentity) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 399 | Medium |
waffle.jaas.WindowsLoginModuleTest$5
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.jaas.WindowsLoginModuleTest$5(WindowsLoginModuleTest, IWindowsAuthProvider, IWindowsIdentity) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 443 | Medium |
waffle.jaas.WindowsLoginModuleTest$6
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.jaas.WindowsLoginModuleTest$6(WindowsLoginModuleTest, IWindowsAuthProvider, IWindowsIdentity) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 497 | Medium |
waffle.jaas.WindowsLoginModuleTest$7
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.jaas.WindowsLoginModuleTest$7(WindowsLoginModuleTest, IWindowsAuthProvider, IWindowsIdentity, IWindowsAccount) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 550 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getFqn() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 555 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getSidString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 558 | Medium |
waffle.jaas.WindowsLoginModuleTest$8
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.jaas.WindowsLoginModuleTest$8(WindowsLoginModuleTest, IWindowsAuthProvider, IWindowsIdentity, IWindowsAccount) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 612 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getFqn() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 616 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getSidString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 619 | Medium |
waffle.jaas.WindowsLoginModuleTest$9
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.jaas.WindowsLoginModuleTest$9(WindowsLoginModuleTest, IWindowsAuthProvider, IWindowsIdentity, IWindowsAccount) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 674 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getFqn() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 678 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getSidString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 680 | Medium |
waffle.servlet.CorsAwareNegotiateSecurityFilterTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.CorsAwareNegotiateSecurityFilterTest.doFilterTestBearerAuthorization() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 94 | Medium |
| Method waffle.servlet.CorsAwareNegotiateSecurityFilterTest.doFilterTestBearerAuthorization() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 105 | Medium |
| Method waffle.servlet.CorsAwareNegotiateSecurityFilterTest.doFilterTestCorsPreflightRequest() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 58 | Medium |
| Method waffle.servlet.CorsAwareNegotiateSecurityFilterTest.doFilterTestCorsPreflightRequest() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 73 | Medium |
waffle.servlet.CorsAwareNegotiateSecurityFilterTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 62 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 60 | Medium |
waffle.servlet.CorsAwareNegotiateSecurityFilterTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.CorsAwareNegotiateSecurityFilterTest$2 at new waffle.servlet.CorsAwareNegotiateSecurityFilterTest$2(CorsAwareNegotiateSecurityFilterTest) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 77 | Medium |
waffle.servlet.CorsAwareNegotiateSecurityFilterTest$3
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 98 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 96 | Medium |
waffle.servlet.CorsAwareNegotiateSecurityFilterTest$4
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.CorsAwareNegotiateSecurityFilterTest$4 at new waffle.servlet.CorsAwareNegotiateSecurityFilterTest$4(CorsAwareNegotiateSecurityFilterTest) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
waffle.servlet.NegotiateSecurityFilter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.NegotiateSecurityFilter.init(FilterConfig) is excessively complex, with a cyclomatic complexity of 68 | STYLE | CC_CYCLOMATIC_COMPLEXITY | 306 | Medium |
| Method waffle.servlet.NegotiateSecurityFilter.init(FilterConfig) accesses list or array with constant index | CORRECTNESS | CLI_CONSTANT_LIST_INDEX | 400 | Medium |
| This use of org/slf4j/Logger.debug(Ljava/lang/String;[Ljava/lang/Object;)V might be used to include CRLF characters into log messages | SECURITY | CRLF_INJECTION_LOGS | 105 | Medium |
| Unconstrained method waffle.servlet.NegotiateSecurityFilter.sendUnauthorized(HttpServletResponse, boolean) converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS | 472 | High |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 167 | Medium |
waffle.servlet.NegotiateSecurityFilterTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.NegotiateSecurityFilterTest.resetWindowsFlag() uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 53 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testCorsAndBearerAuthorizationI_init(FilterConfig) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 118 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testCorsAndBearerAuthorizationI_init(FilterConfig) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 119 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsDisableSSOCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 397 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsDisableSSOCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 405 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsNoAuthHeaderSendsUnauthorized(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 453 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsNonWindowsPrincipalInSessionCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, Principal) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 526 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsWindowsPrincipalInSessionCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, IWindowsIdentity) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 604 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsWithAuthHeaderAuthenticates(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, IWindowsIdentity) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 698 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testInitWithDisableSSO(FilterConfig, IWindowsAuthProvider) uses AccessibleObject.setAccessible to modify accessibility of classes | CORRECTNESS | RFI_SET_ACCESSIBLE | 372 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testCorsAndBearerAuthorizationI_init(FilterConfig) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 89 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testCorsAndBearerAuthorizationI_init(FilterConfig) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 125 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnNonWindowsCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 316 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnNonWindowsCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 332 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsDisableSSOCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 408 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsDisableSSOCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 424 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsNoAuthHeaderSendsUnauthorized(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 459 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsNoAuthHeaderSendsUnauthorized(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 487 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsNonWindowsPrincipalInSessionCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, Principal) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 534 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsNonWindowsPrincipalInSessionCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, Principal) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 568 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsWindowsPrincipalInSessionCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, IWindowsIdentity) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 612 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsWindowsPrincipalInSessionCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, IWindowsIdentity) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 631 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsWindowsPrincipalInSessionCallsChain(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, IWindowsIdentity) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 662 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsWithAuthHeaderAuthenticates(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, IWindowsIdentity) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 706 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testDoFilterOnWindowsWithAuthHeaderAuthenticates(HttpServletRequest, HttpServletResponse, FilterChain, IWindowsAuthProvider, SecurityFilterProviderCollection, HttpSession, IWindowsIdentity) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 766 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testExcludeCorsAndOAUTHBearerAuthorization_doFilter(HttpServletRequest, HttpServletResponse, FilterChain, FilterConfig) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 155 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testExcludeCorsAndOAUTHBearerAuthorization_doFilter(HttpServletRequest, HttpServletResponse, FilterChain, FilterConfig) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 190 | Medium |
| Method waffle.servlet.NegotiateSecurityFilterTest.testInitWithDisableSSO(FilterConfig, IWindowsAuthProvider) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 357 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$10
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.NegotiateSecurityFilterTest$10 at new waffle.servlet.NegotiateSecurityFilterTest$10(NegotiateSecurityFilterTest, FilterChain, HttpServletRequest, HttpServletResponse) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 426 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$11
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 479 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 461 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURI() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 464 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURL() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 470 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getSession(boolean) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 476 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 473 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$12
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.NegotiateSecurityFilterTest$12 at new waffle.servlet.NegotiateSecurityFilterTest$12(NegotiateSecurityFilterTest, HttpServletResponse, FilterChain) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 489 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$13
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.servlet.NegotiateSecurityFilterTest$13(NegotiateSecurityFilterTest, HttpServletRequest, HttpSession, String, Principal, SecurityFilterProviderCollection) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 558 | Medium |
| Return value of java.security.Principal.getName() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 560 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 536 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURI() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 539 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURL() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 545 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getSession(boolean) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 551 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 548 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$14
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.NegotiateSecurityFilterTest$14 at new waffle.servlet.NegotiateSecurityFilterTest$14(NegotiateSecurityFilterTest, FilterChain, HttpServletRequest, HttpServletResponse) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 570 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$16
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method new waffle.servlet.NegotiateSecurityFilterTest$16(NegotiateSecurityFilterTest, HttpServletRequest, HttpSession, String, WindowsPrincipal, SecurityFilterProviderCollection) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 655 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 633 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURI() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 636 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURL() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 642 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getSession(boolean) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 648 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 645 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$17
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.NegotiateSecurityFilterTest$17 at new waffle.servlet.NegotiateSecurityFilterTest$17(NegotiateSecurityFilterTest, FilterChain, HttpServletResponse) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 664 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$18
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.NegotiateSecurityFilterTest$18 at new waffle.servlet.NegotiateSecurityFilterTest$18(NegotiateSecurityFilterTest, IWindowsIdentity, HttpServletRequest, HttpSession, String, SecurityFilterProviderCollection, HttpServletResponse) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 750 | Medium |
| Method new waffle.servlet.NegotiateSecurityFilterTest$18(NegotiateSecurityFilterTest, IWindowsIdentity, HttpServletRequest, HttpSession, String, SecurityFilterProviderCollection, HttpServletResponse) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 719 | Medium |
| Method new waffle.servlet.NegotiateSecurityFilterTest$18(NegotiateSecurityFilterTest, IWindowsIdentity, HttpServletRequest, HttpSession, String, SecurityFilterProviderCollection, HttpServletResponse) needlessly boxes a boolean constant | PERFORMANCE | NAB_NEEDLESS_BOOLEAN_CONSTANT_CONVERSION | 745 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 747 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 724 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURI() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 727 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURL() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 733 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getSession(boolean) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 739 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 736 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$19
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.NegotiateSecurityFilterTest$19 at new waffle.servlet.NegotiateSecurityFilterTest$19(NegotiateSecurityFilterTest, FilterChain, HttpServletResponse) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 768 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$4
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 181 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 178 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$5
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.NegotiateSecurityFilterTest$5 at new waffle.servlet.NegotiateSecurityFilterTest$5(NegotiateSecurityFilterTest, FilterChain, HttpServletRequest, HttpServletResponse) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 192 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$6
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 318 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURI() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 321 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$7
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.NegotiateSecurityFilterTest$7 at new waffle.servlet.NegotiateSecurityFilterTest$7(NegotiateSecurityFilterTest, FilterChain, HttpServletRequest, HttpServletResponse) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 334 | Medium |
waffle.servlet.NegotiateSecurityFilterTest$9
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 410 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getRequestURI() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 413 | Medium |
waffle.servlet.WaffleInfoServlet
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Unconstrained method waffle.servlet.WaffleInfoServlet.getWaffleInfoResponse(HttpServletRequest, HttpServletResponse) converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS | 94 | High |
| Method waffle.servlet.WaffleInfoServlet.getWaffleInfoResponse(HttpServletRequest, HttpServletResponse) throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 94 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 93 | Medium |
waffle.servlet.WaffleInfoServletTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.WaffleInfoServletTest.testDoGetNoPrincipalNoHeaders(HttpServletRequest, HttpServletResponse) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 76 | Medium |
| Method waffle.servlet.WaffleInfoServletTest.testDoGetWithAuthType(HttpServletRequest, HttpServletResponse) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 162 | Medium |
| Method waffle.servlet.WaffleInfoServletTest.testDoGetWithHeaders(HttpServletRequest, HttpServletResponse) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 252 | Medium |
| Method waffle.servlet.WaffleInfoServletTest.testDoGetWithLookup(HttpServletRequest, HttpServletResponse) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 301 | Medium |
| Method waffle.servlet.WaffleInfoServletTest.testDoGetWithPrincipal(HttpServletRequest, HttpServletResponse, Principal) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 206 | Medium |
| Method waffle.servlet.WaffleInfoServletTest.testDoPost(HttpServletRequest, HttpServletResponse) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 120 | Medium |
waffle.servlet.WaffleInfoServletTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.WaffleInfoServletTest$1 at new waffle.servlet.WaffleInfoServletTest$1(WaffleInfoServletTest, Document, HttpServletRequest, HttpServletResponse, PrintWriter) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 78 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getAuthType() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 80 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getHeaderNames() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 84 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 82 | Medium |
waffle.servlet.WaffleInfoServletTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.WaffleInfoServletTest$2 at new waffle.servlet.WaffleInfoServletTest$2(WaffleInfoServletTest, Document, HttpServletRequest, HttpServletResponse, PrintWriter) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 122 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getAuthType() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 124 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getHeaderNames() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 128 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 126 | Medium |
waffle.servlet.WaffleInfoServletTest$3
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.WaffleInfoServletTest$3 at new waffle.servlet.WaffleInfoServletTest$3(WaffleInfoServletTest, Document, HttpServletRequest, HttpServletResponse, PrintWriter) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 164 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getAuthType() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 166 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getHeaderNames() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 170 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 168 | Medium |
waffle.servlet.WaffleInfoServletTest$4
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.WaffleInfoServletTest$4 at new waffle.servlet.WaffleInfoServletTest$4(WaffleInfoServletTest, Document, HttpServletRequest, Principal, HttpServletResponse, PrintWriter) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 208 | Medium |
| Method new waffle.servlet.WaffleInfoServletTest$4(WaffleInfoServletTest, Document, HttpServletRequest, Principal, HttpServletResponse, PrintWriter) ignores return value of a non mutating method | CORRECTNESS | NPMC_NON_PRODUCTIVE_METHOD_CALL | 216 | Medium |
| Return value of java.security.Principal.getName() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 214 | Medium |
| Return value of java.security.Principal.toString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 216 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getAuthType() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 210 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getHeaderNames() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 218 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 212 | Medium |
waffle.servlet.WaffleInfoServletTest$5
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.WaffleInfoServletTest$5 at new waffle.servlet.WaffleInfoServletTest$5(WaffleInfoServletTest, Document, HttpServletRequest, HttpServletResponse, PrintWriter) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 254 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getAuthType() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 256 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 262 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getHeaderNames() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 260 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 258 | Medium |
waffle.servlet.WaffleInfoServletTest$6
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.WaffleInfoServletTest$6 at new waffle.servlet.WaffleInfoServletTest$6(WaffleInfoServletTest, Document, HttpServletRequest, Element, HttpServletResponse, PrintWriter) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 303 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getAuthType() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 305 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getHeaderNames() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 309 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getUserPrincipal() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 307 | Medium |
waffle.servlet.WindowsPrincipal
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| waffle.servlet.WindowsPrincipal.getGroups() may expose internal representation by returning WindowsPrincipal.groups | MALICIOUS_CODE | EI_EXPOSE_REP | 123 | Medium |
| Class waffle.servlet.WindowsPrincipal 'overloads' a method with both instance and static versions | STYLE | MOM_MISLEADING_OVERLOAD_MODEL | 123 | Medium |
| Method waffle.servlet.WindowsPrincipal.getGroups(IWindowsAccount[]) does not presize the allocation of a collection | PERFORMANCE | PSC_PRESIZE_COLLECTIONS | 112 | Medium |
waffle.servlet.spi.BasicSecurityFilterProviderTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.spi.BasicSecurityFilterProviderTest.testSendUnauthorized() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 109 | Medium |
| Method waffle.servlet.spi.BasicSecurityFilterProviderTest.testSendUnauthorizedWithCustomRealm() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 125 | Medium |
| Method waffle.servlet.spi.BasicSecurityFilterProviderTest.testSendUnauthorizedWithRealmViaInit() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 157 | Medium |
| Method waffle.servlet.spi.BasicSecurityFilterProviderTest.testSendUnauthorizedWithRealmViaInit() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 164 | Medium |
waffle.servlet.spi.NegotiateSecurityFilterProvider
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V might be used to include CRLF characters into log messages | SECURITY | CRLF_INJECTION_LOGS | 110 | Medium |
| waffle.servlet.spi.NegotiateSecurityFilterProvider.getProtocols() may expose internal representation by returning NegotiateSecurityFilterProvider.protocolsList | MALICIOUS_CODE | EI_EXPOSE_REP | 71 | Medium |
| waffle.servlet.spi.NegotiateSecurityFilterProvider.setProtocols(List) may expose internal representation by storing an externally mutable object into NegotiateSecurityFilterProvider.protocolsList | MALICIOUS_CODE | EI_EXPOSE_REP2 | 81 | Medium |
waffle.servlet.spi.NegotiateSecurityFilterProviderTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.spi.NegotiateSecurityFilterProviderTest.testSendUnauthorizedWithCustomProtocols() builds a list from one element using Arrays.asList rather than Collections.singletonList | CORRECTNESS | LUI_USE_SINGLETON_LIST | 118 | Medium |
| Method waffle.servlet.spi.NegotiateSecurityFilterProviderTest.testSetProtocols() builds a list from one element using Arrays.asList rather than Collections.singletonList | CORRECTNESS | LUI_USE_SINGLETON_LIST | 63 | Medium |
| Method waffle.servlet.spi.NegotiateSecurityFilterProviderTest.testSendUnauthorized() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 103 | Medium |
| Method waffle.servlet.spi.NegotiateSecurityFilterProviderTest.testSendUnauthorizedWithCustomProtocols() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 120 | Medium |
waffle.servlet.spi.SecurityFilterProviderCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.servlet.spi.SecurityFilterProviderCollection at new waffle.servlet.spi.SecurityFilterProviderCollection(String[], IWindowsAuthProvider) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 73 | Medium |
| Unconstrained method new waffle.servlet.spi.SecurityFilterProviderCollection(String[], IWindowsAuthProvider) converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS | 73 | High |
| Method waffle.servlet.spi.SecurityFilterProviderCollection.doFilter(HttpServletRequest, HttpServletResponse) appears to call the same method on the same object redundantly | PERFORMANCE | PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS | 140 | Medium |
| Method new waffle.servlet.spi.SecurityFilterProviderCollection(SecurityFilterProvider[]) does not presize the allocation of a collection | PERFORMANCE | PSC_PRESIZE_COLLECTIONS | 47 | Medium |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 77 | Medium |
waffle.servlet.spi.SecurityFilterProviderCollectionTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.servlet.spi.SecurityFilterProviderCollectionTest.lambda$testConstructorWithInvalidClassName$0(String[]) uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 134 | Medium |
| Method waffle.servlet.spi.SecurityFilterProviderCollectionTest.testSendUnauthorized() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 89 | Medium |
waffle.util.AuthorizationHeader
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.util.AuthorizationHeader.getTokenBytes() throws alternative exception from catch block without history | CORRECTNESS | LEST_LOST_EXCEPTION_STACK_TRACE | 106 | Medium |
| Method waffle.util.AuthorizationHeader.isBearerAuthorizationHeader() makes literal string comparisons passing the literal as an argument | STYLE | LSC_LITERAL_STRING_COMPARISON | 174 | High |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 105 | Medium |
| Method waffle.util.AuthorizationHeader.isBearerAuthorizationHeader() compares string without case after enforcing a case | PERFORMANCE | SPP_USELESS_CASING | 174 | Medium |
waffle.util.AuthorizationHeaderTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.util.AuthorizationHeaderTest.testGetHeader() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 37 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testGetSecurityPackageBearer() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 127 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testGetSecurityPackageNegotiate() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 112 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testGetSecurityPackageNtlm() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 97 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testGetSecurityPackageThrowsWhenNoSpace() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 157 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testGetSecurityPackageThrowsWhenNull() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 142 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testGetToken() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 203 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testGetTokenBytes() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 218 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testGetTokenBytesThrowsOnInvalidBase64() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 235 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsBearerAuthorizationHeaderFalseForNtlm() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 486 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsBearerAuthorizationHeaderFalseWhenNull() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 501 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsBearerAuthorizationHeaderTrue() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 456 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsBearerAuthorizationHeaderTrueUpperCase() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 471 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1MessageFalseForSpnego() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 280 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1MessageFalseWhenNull() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 265 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1MessageTrue() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 250 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1PostAuthorizationHeaderDelete() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 378 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1PostAuthorizationHeaderGetReturnsFalse() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 398 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1PostAuthorizationHeaderPostNoContent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 340 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1PostAuthorizationHeaderPut() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 359 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1PostAuthorizationHeaderSpnegoPost() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 437 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1PostAuthorizationHeaderWithContentReturnsFalse() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 417 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNullFalseWhenPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 82 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNullWhenAbsent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 52 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsNullWhenEmpty() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 67 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsSPNegTokenInitMessageFalseForNtlm() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 325 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsSPNegTokenInitMessageFalseWhenNull() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 310 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testIsSPNegTokenInitMessageTrue() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 295 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testToStringWhenNull() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 172 | Medium |
| Method waffle.util.AuthorizationHeaderTest.testToStringWhenPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 188 | Medium |
waffle.util.AuthorizationHeaderTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 39 | Medium |
waffle.util.AuthorizationHeaderTest$10
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 174 | Medium |
waffle.util.AuthorizationHeaderTest$11
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 190 | Medium |
waffle.util.AuthorizationHeaderTest$12
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 205 | Medium |
waffle.util.AuthorizationHeaderTest$13
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 220 | Medium |
waffle.util.AuthorizationHeaderTest$14
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 237 | Medium |
waffle.util.AuthorizationHeaderTest$15
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 252 | Medium |
waffle.util.AuthorizationHeaderTest$16
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 267 | Medium |
waffle.util.AuthorizationHeaderTest$17
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 282 | Medium |
waffle.util.AuthorizationHeaderTest$18
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 297 | Medium |
waffle.util.AuthorizationHeaderTest$19
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 312 | Medium |
waffle.util.AuthorizationHeaderTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 54 | Medium |
waffle.util.AuthorizationHeaderTest$20
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 327 | Medium |
waffle.util.AuthorizationHeaderTest$21
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 342 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 344 | Medium |
waffle.util.AuthorizationHeaderTest$22
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 361 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 363 | Medium |
waffle.util.AuthorizationHeaderTest$23
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 380 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 382 | Medium |
waffle.util.AuthorizationHeaderTest$24
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 402 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 400 | Medium |
waffle.util.AuthorizationHeaderTest$25
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 423 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 419 | Medium |
waffle.util.AuthorizationHeaderTest$26
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 439 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 441 | Medium |
waffle.util.AuthorizationHeaderTest$27
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 458 | Medium |
waffle.util.AuthorizationHeaderTest$28
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 473 | Medium |
waffle.util.AuthorizationHeaderTest$29
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 488 | Medium |
waffle.util.AuthorizationHeaderTest$3
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 69 | Medium |
waffle.util.AuthorizationHeaderTest$30
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 503 | Medium |
waffle.util.AuthorizationHeaderTest$4
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 84 | Medium |
waffle.util.AuthorizationHeaderTest$5
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 99 | Medium |
waffle.util.AuthorizationHeaderTest$6
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 114 | Medium |
waffle.util.AuthorizationHeaderTest$7
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 129 | Medium |
waffle.util.AuthorizationHeaderTest$8
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 144 | Medium |
waffle.util.AuthorizationHeaderTest$9
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 159 | Medium |
waffle.util.CorsPreFlightCheck
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.util.CorsPreFlightCheck.isPreflight(HttpServletRequest) makes literal string comparisons passing the literal as an argument | STYLE | LSC_LITERAL_STRING_COMPARISON | 57 | High |
| Method waffle.util.CorsPreFlightCheck.isPreflight(HttpServletRequest) makes literal string comparisons passing the literal as an argument | STYLE | LSC_LITERAL_STRING_COMPARISON | 67 | High |
waffle.util.CorsPreFlightCheckTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.util.CorsPreFlightCheckTest.testCorsFilterPreFlightAttributeReturnsTrue() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 192 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testCorsMethodPreflightHeadersPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 115 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testCorsMethodPreflightHeadersPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 126 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testExpectedCorsPreflightHeadersPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 45 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testExpectedCorsPreflightHeadersPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 60 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNoCorsHeadersPreflightHeaderPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 143 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNoCorsHeadersPreflightHeaderPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 159 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNoCorsPreflightOriginPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 79 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNoCorsPreflightOriginPresent() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 95 | Medium |
| Method waffle.util.CorsPreFlightCheckTest.testNonOptionsMethodReturnsFalse() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 178 | Medium |
waffle.util.CorsPreFlightCheckTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 49 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 47 | Medium |
waffle.util.CorsPreFlightCheckTest$10
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 194 | Medium |
waffle.util.CorsPreFlightCheckTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 64 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 62 | Medium |
waffle.util.CorsPreFlightCheckTest$3
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 83 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 81 | Medium |
waffle.util.CorsPreFlightCheckTest$4
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 99 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 97 | Medium |
waffle.util.CorsPreFlightCheckTest$5
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 119 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 117 | Medium |
waffle.util.CorsPreFlightCheckTest$6
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 130 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 128 | Medium |
waffle.util.CorsPreFlightCheckTest$7
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 148 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 145 | Medium |
waffle.util.CorsPreFlightCheckTest$8
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getHeader(String) ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 164 | Medium |
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 161 | Medium |
waffle.util.CorsPreFlightCheckTest$9
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of javax.servlet.http.HttpServletRequest.getMethod() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 180 | Medium |
waffle.util.NtlmMessage
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Hard coded cryptographic key found | SECURITY | HARD_CODE_KEY | 15-56 | Medium |
waffle.util.NtlmServletRequestTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.util.NtlmServletRequestTest.testGetConnectionIdFallsBackToRemoteAddr() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 47 | Medium |
| Method waffle.util.NtlmServletRequestTest.testGetConnectionIdFormat() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 83 | Medium |
| Method waffle.util.NtlmServletRequestTest.testGetConnectionIdUsesRemoteHost() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 31 | Medium |
| Method waffle.util.NtlmServletRequestTest.testGetConnectionIdWithBothHostAndAddrNull() uses a Side Effect Constructor | STYLE | SEC_SIDE_EFFECT_CONSTRUCTOR | 65 | Medium |
waffle.util.WaffleInfo
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| This use of org/slf4j/Logger.error(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages | SECURITY | CRLF_INJECTION_LOGS | 325 | Medium |
| Format should be constant. Use placeholder to reduce the needless cost of parameter construction. see http://www.slf4j.org/faq.html#logging_performance | CORRECTNESS | SLF4J_FORMAT_SHOULD_BE_CONST | 346 | High |
| Format should be constant. Use placeholder to reduce the needless cost of parameter construction. see http://www.slf4j.org/faq.html#logging_performance | CORRECTNESS | SLF4J_FORMAT_SHOULD_BE_CONST | 349 | High |
| To make log readable, log format () should contain non-sign character. | BAD_PRACTICE | SLF4J_SIGN_ONLY_FORMAT | 350 | Medium |
waffle.util.WaffleInfoTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of waffle.windows.auth.IWindowsAccount.getDomain() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 184 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getFqn() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 182 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getName() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 180 | Medium |
| Return value of waffle.windows.auth.IWindowsAccount.getSidString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 186 | Medium |
waffle.util.cache.Cache
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Unconstrained method waffle.util.cache.Cache.newCache(int) converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS | 67 | High |
waffle.windows.auth.WindowsAccountValueTest
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| JUnit test method waffle.windows.auth.WindowsAccountValueTest.testNotEqualsNull() passes null to Assert.assertNotEquals | CORRECTNESS | UTAO_JUNIT_ASSERTION_ODDITIES_USE_ASSERT_NOT_NULL | 115 | Medium |
waffle.windows.auth.WindowsAccountValueTest$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of IWindowsAccount.getDomain() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 41 | Medium |
| Return value of IWindowsAccount.getFqn() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 37 | Medium |
| Return value of IWindowsAccount.getName() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 39 | Medium |
| Return value of IWindowsAccount.getSidString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 35 | Medium |
waffle.windows.auth.WindowsAccountValueTest$2
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of IWindowsAccount.getDomain() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 93 | Medium |
| Return value of IWindowsAccount.getFqn() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 89 | Medium |
| Return value of IWindowsAccount.getName() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 91 | Medium |
| Return value of IWindowsAccount.getSidString() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 87 | Medium |
waffle.windows.auth.impl.WindowsAuthProviderImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.windows.auth.impl.WindowsAuthProviderImpl at new waffle.windows.auth.impl.WindowsAuthProviderImpl() will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 76 | Medium |
| Exception thrown in class waffle.windows.auth.impl.WindowsAuthProviderImpl at new waffle.windows.auth.impl.WindowsAuthProviderImpl(int) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 86 | Medium |
| Constrained method waffle.windows.auth.impl.WindowsAuthProviderImpl.getCurrentComputer() converts checked exception to unchecked | STYLE | EXS_EXCEPTION_SOFTENING_NO_CHECKED | 170 | Medium |
| Method waffle.windows.auth.impl.WindowsAuthProviderImpl.getCurrentComputer() calls InetAddress.getLocalHost(), which may be a security risk | CORRECTNESS | MDM_INETADDRESS_GETLOCALHOST | 168 | Medium |
| Method waffle.windows.auth.impl.WindowsAuthProviderImpl.getDomains() does not presize the allocation of a collection | PERFORMANCE | PSC_PRESIZE_COLLECTIONS | 179 | Medium |
waffle.windows.auth.impl.WindowsComputerImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Method waffle.windows.auth.impl.WindowsComputerImpl.getGroups() does not presize the allocation of a collection | PERFORMANCE | PSC_PRESIZE_COLLECTIONS | 50 | Medium |
waffle.windows.auth.impl.WindowsCredentialsHandleImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| waffle.windows.auth.impl.WindowsCredentialsHandleImpl.getHandle() may expose internal representation by returning WindowsCredentialsHandleImpl.handle | MALICIOUS_CODE | EI_EXPOSE_REP | 102 | Medium |
waffle.windows.auth.impl.WindowsIdentityImpersonationContextImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.windows.auth.impl.WindowsIdentityImpersonationContextImpl at new waffle.windows.auth.impl.WindowsIdentityImpersonationContextImpl(WinNT$HANDLE) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 29 | Medium |
waffle.windows.auth.impl.WindowsIdentityImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new waffle.windows.auth.impl.WindowsIdentityImpl(WinNT$HANDLE) may expose internal representation by storing an externally mutable object into WindowsIdentityImpl.windowsIdentity | MALICIOUS_CODE | EI_EXPOSE_REP2 | 43 | Medium |
waffle.windows.auth.impl.WindowsSecurityContextImpersonationContextImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class waffle.windows.auth.impl.WindowsSecurityContextImpersonationContextImpl at new waffle.windows.auth.impl.WindowsSecurityContextImpersonationContextImpl(Sspi$CtxtHandle) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 33 | Medium |
| new waffle.windows.auth.impl.WindowsSecurityContextImpersonationContextImpl(Sspi$CtxtHandle) may expose internal representation by storing an externally mutable object into WindowsSecurityContextImpersonationContextImpl.ctx | MALICIOUS_CODE | EI_EXPOSE_REP2 | 36 | Medium |
waffle.windows.auth.impl.WindowsSecurityContextImpl
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| waffle.windows.auth.impl.WindowsSecurityContextImpl.getHandle() may expose internal representation by returning WindowsSecurityContextImpl.ctx | MALICIOUS_CODE | EI_EXPOSE_REP | 178 | Medium |
| waffle.windows.auth.impl.WindowsSecurityContextImpl.setSecurityContext(Sspi$CtxtHandle) may expose internal representation by storing an externally mutable object into WindowsSecurityContextImpl.ctx | MALICIOUS_CODE | EI_EXPOSE_REP2 | 218 | Medium |
| Class waffle.windows.auth.impl.WindowsSecurityContextImpl 'overloads' a method with both instance and static versions | STYLE | MOM_MISLEADING_OVERLOAD_MODEL | 151-158 | Medium |