Built by Maven

SpotBugs Bug Detector Report

The following document contains the results of SpotBugs

SpotBugs Version is 4.10.4

Threshold is medium

Effort is

Summary

Classes Bugs Errors Missing Classes
28 25 0 0

Files

Class Bugs
waffle.shiro.GroupMappingWaffleRealm 1
waffle.shiro.GroupMappingWaffleRealmTest 1
waffle.shiro.WaffleFqnPrincipal 4
waffle.shiro.WaffleFqnPrincipalTest 1
waffle.shiro.negotiate.AuthenticationInProgressException 1
waffle.shiro.negotiate.MockServletResponse 1
waffle.shiro.negotiate.NegotiateAuthenticationFilter 5
waffle.shiro.negotiate.NegotiateAuthenticationFilterTest 1
waffle.shiro.negotiate.NegotiateAuthenticationRealmTest$1 1
waffle.shiro.negotiate.NegotiateInfo 3
waffle.shiro.negotiate.NegotiateToken 6

waffle.shiro.GroupMappingWaffleRealm

Bug Category Details Line Priority
Method waffle.shiro.GroupMappingWaffleRealm.getRoleNamesForGroups(Collection) returns java.util.Collection CORRECTNESS IMC_IMMATURE_CLASS_COLLECTION_RETURN 54 Medium

waffle.shiro.GroupMappingWaffleRealmTest

Bug Category Details Line Priority
The windowsAuthProvider field in class waffle.shiro.GroupMappingWaffleRealmTest is used only as a local, but defined on class level CORRECTNESS FCBL_FIELD_COULD_BE_LOCAL 46 Medium

waffle.shiro.WaffleFqnPrincipal

Bug Category Details Line Priority
Method new waffle.shiro.WaffleFqnPrincipal(IWindowsIdentity) does not presize the allocation of a collection PERFORMANCE PSC_PRESIZE_COLLECTIONS 40 Medium
Method waffle.shiro.WaffleFqnPrincipal.toString() passes constant String of length 1 to character overridden method PERFORMANCE UCPM_USE_CHARACTER_PARAMETERIZED_METHOD 78 Medium
Method waffle.shiro.WaffleFqnPrincipal.toString() passes constant String of length 1 to character overridden method PERFORMANCE UCPM_USE_CHARACTER_PARAMETERIZED_METHOD 80 Medium
Method waffle.shiro.WaffleFqnPrincipal.toString() passes constant String of length 1 to character overridden method PERFORMANCE UCPM_USE_CHARACTER_PARAMETERIZED_METHOD 82 Medium

waffle.shiro.WaffleFqnPrincipalTest

Bug Category Details Line Priority
JUnit test method waffle.shiro.WaffleFqnPrincipalTest.testNotEqualsNull() passes null to Assert.assertNotEquals CORRECTNESS UTAO_JUNIT_ASSERTION_ODDITIES_USE_ASSERT_NOT_NULL 92 Medium

waffle.shiro.negotiate.AuthenticationInProgressException

Bug Category Details Line Priority
Class waffle.shiro.negotiate.AuthenticationInProgressException defines a computed serialVersionUID that doesn't equate to the calculated value CORRECTNESS IMC_IMMATURE_CLASS_BAD_SERIALVERSIONUID Not available Medium

waffle.shiro.negotiate.MockServletResponse

Bug Category Details Line Priority
Method waffle.shiro.negotiate.MockServletResponse.addHeader(String, String) checks a map with containsKey(), before using get() CORRECTNESS MUI_CONTAINSKEY_BEFORE_GET 39 Medium

waffle.shiro.negotiate.NegotiateAuthenticationFilter

Bug Category Details Line Priority
This use of org/slf4j/Logger.debug(Ljava/lang/String;[Ljava/lang/Object;)V might be used to include CRLF characters into log messages SECURITY CRLF_INJECTION_LOGS 113 Medium
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages SECURITY CRLF_INJECTION_LOGS 135 Medium
Unconstrained method waffle.shiro.negotiate.NegotiateAuthenticationFilter.sendChallengeOnFailure(ServletResponse) converts checked exception to unchecked STYLE EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS 325 High
This use of javax/servlet/http/HttpServletResponse.addHeader(Ljava/lang/String;Ljava/lang/String;)V might be used to include CRLF characters into HTTP headers SECURITY HTTP_RESPONSE_SPLITTING 358 Medium
waffle.shiro.negotiate.NegotiateAuthenticationFilter.sendUnauthorized(List, byte[], HttpServletResponse): 1st parameter 'protocols' could be declared as java.lang.Iterable instead STYLE OCP_OVERLY_CONCRETE_PARAMETER 356 Medium

waffle.shiro.negotiate.NegotiateAuthenticationFilterTest

Bug Category Details Line Priority
The out field in class waffle.shiro.negotiate.NegotiateAuthenticationFilterTest is used only as a local, but defined on class level CORRECTNESS FCBL_FIELD_COULD_BE_LOCAL 68 Medium

waffle.shiro.negotiate.NegotiateAuthenticationRealmTest$1

Bug Category Details Line Priority
Return value of NegotiateToken.getIn() ignored, but method has no side effect STYLE RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT 52 Medium

waffle.shiro.negotiate.NegotiateInfo

Bug Category Details Line Priority
waffle.shiro.negotiate.NegotiateInfo.getCredentials() may expose internal representation by returning NegotiateInfo.subject MALICIOUS_CODE EI_EXPOSE_REP 65 Medium
new waffle.shiro.negotiate.NegotiateInfo(Subject, String) may expose internal representation by storing an externally mutable object into NegotiateInfo.subject MALICIOUS_CODE EI_EXPOSE_REP2 44 Medium
Class waffle.shiro.negotiate.NegotiateInfo defines a computed serialVersionUID that doesn't equate to the calculated value CORRECTNESS IMC_IMMATURE_CLASS_BAD_SERIALVERSIONUID Not available Medium

waffle.shiro.negotiate.NegotiateToken

Bug Category Details Line Priority
waffle.shiro.negotiate.NegotiateToken.getCredentials() may expose internal representation by returning NegotiateToken.subject MALICIOUS_CODE EI_EXPOSE_REP 121 Medium
waffle.shiro.negotiate.NegotiateToken.getSubject() may expose internal representation by returning NegotiateToken.subject MALICIOUS_CODE EI_EXPOSE_REP 173 Medium
new waffle.shiro.negotiate.NegotiateToken(byte[], byte[], String, String, boolean, boolean, String) may expose internal representation by storing an externally mutable object into NegotiateToken.in MALICIOUS_CODE EI_EXPOSE_REP2 82 Medium
new waffle.shiro.negotiate.NegotiateToken(byte[], byte[], String, String, boolean, boolean, String) may expose internal representation by storing an externally mutable object into NegotiateToken.out MALICIOUS_CODE EI_EXPOSE_REP2 83 Medium
waffle.shiro.negotiate.NegotiateToken.setSubject(Subject) may expose internal representation by storing an externally mutable object into NegotiateToken.subject MALICIOUS_CODE EI_EXPOSE_REP2 155 Medium
Class waffle.shiro.negotiate.NegotiateToken defines a computed serialVersionUID that doesn't equate to the calculated value CORRECTNESS IMC_IMMATURE_CLASS_BAD_SERIALVERSIONUID Not available Medium