Built by Maven

SpotBugs Bug Detector Report

The following document contains the results of SpotBugs

SpotBugs Version is 4.10.4

Threshold is medium

Effort is

Summary

Classes Bugs Errors Missing Classes
39 38 0 0

Files

Class Bugs
waffle.jaas.UsernamePasswordCallbackHandler 1
waffle.mock.MockWindowsAuthProviderTest 1
waffle.mock.MockWindowsIdentity 2
waffle.mock.http.SimpleFilterChain 4
waffle.mock.http.SimpleHttpRequest 5
waffle.mock.http.SimpleHttpResponse 4
waffle.mock.http.SimpleRequestDispatcher 1
waffle.mock.http.SimpleRequestDispatcherTest 1
waffle.servlet.ImpersonateTest 2
waffle.servlet.NegotiateSecurityFilterTest 2
waffle.servlet.WindowsPrincipalTest 1
waffle.util.AuthorizationHeaderTest 4
waffle.windows.auth.WindowsAuthProviderTest 10

waffle.jaas.UsernamePasswordCallbackHandler

Bug Category Details Line Priority
Method waffle.jaas.UsernamePasswordCallbackHandler.handle(Callback[]) uses instanceof on multiple types to arbitrate logic STYLE ITC_INHERITANCE_TYPE_CHECKING 44 Medium

waffle.mock.MockWindowsAuthProviderTest

Bug Category Details Line Priority
Method waffle.mock.MockWindowsAuthProviderTest.testInitialGroupsContainUsersAndEveryone() does not presize the allocation of a collection PERFORMANCE PSC_PRESIZE_COLLECTIONS 137 Medium

waffle.mock.MockWindowsIdentity

Bug Category Details Line Priority
new waffle.mock.MockWindowsIdentity(String, List) may expose internal representation by storing an externally mutable object into MockWindowsIdentity.groups MALICIOUS_CODE EI_EXPOSE_REP2 37 Medium
Method waffle.mock.MockWindowsIdentity.getGroups() does not presize the allocation of a collection PERFORMANCE PSC_PRESIZE_COLLECTIONS 49 Medium

waffle.mock.http.SimpleFilterChain

Bug Category Details Line Priority
waffle.mock.http.SimpleFilterChain.getRequest() may expose internal representation by returning SimpleFilterChain.request MALICIOUS_CODE EI_EXPOSE_REP 33 Medium
waffle.mock.http.SimpleFilterChain.getResponse() may expose internal representation by returning SimpleFilterChain.response MALICIOUS_CODE EI_EXPOSE_REP 42 Medium
waffle.mock.http.SimpleFilterChain.doFilter(ServletRequest, ServletResponse) may expose internal representation by storing an externally mutable object into SimpleFilterChain.request MALICIOUS_CODE EI_EXPOSE_REP2 47 Medium
waffle.mock.http.SimpleFilterChain.doFilter(ServletRequest, ServletResponse) may expose internal representation by storing an externally mutable object into SimpleFilterChain.response MALICIOUS_CODE EI_EXPOSE_REP2 48 Medium

waffle.mock.http.SimpleHttpRequest

Bug Category Details Line Priority
waffle.mock.http.SimpleHttpRequest.getSession() may expose internal representation by returning SimpleHttpRequest.session MALICIOUS_CODE EI_EXPOSE_REP 164 Medium
waffle.mock.http.SimpleHttpRequest.getSession(boolean) may expose internal representation by returning SimpleHttpRequest.session MALICIOUS_CODE EI_EXPOSE_REP 172 Medium
This method waffle.mock.http.SimpleHttpRequest.setQueryString(String) parses a String that is a field STYLE STT_STRING_PARSING_A_FIELD 189 Medium
Static synchronized method waffle.mock.http.SimpleHttpRequest.nextRemotePort() uses intrinsic lock of class waffle.mock.http.SimpleHttpRequest for synchronization, exposing the class to untrusted code. SECURITY USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION 80 Medium
Static synchronized method waffle.mock.http.SimpleHttpRequest.resetRemotePort() uses intrinsic lock of class waffle.mock.http.SimpleHttpRequest for synchronization, exposing the class to untrusted code. SECURITY USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION 87-88 Medium

waffle.mock.http.SimpleHttpResponse

Bug Category Details Line Priority
waffle.mock.http.SimpleHttpResponse.getOutputStream() may expose internal representation by returning SimpleHttpResponse.out MALICIOUS_CODE EI_EXPOSE_REP 186 Medium
waffle.mock.http.SimpleHttpResponse.getWriter() may expose internal representation by returning SimpleHttpResponse.writer MALICIOUS_CODE EI_EXPOSE_REP 181 Medium
To make log readable, log format ({}: {}) should contain non-sign character. BAD_PRACTICE SLF4J_SIGN_ONLY_FORMAT 125 Medium
To make log readable, log format ({}: {}) should contain non-sign character. BAD_PRACTICE SLF4J_SIGN_ONLY_FORMAT 128 Medium

waffle.mock.http.SimpleRequestDispatcher

Bug Category Details Line Priority
The following redirection could be used by an attacker to redirect users to a phishing website. SECURITY UNVALIDATED_REDIRECT 40 Medium

waffle.mock.http.SimpleRequestDispatcherTest

Bug Category Details Line Priority
RequestDispatcher populated with user controlled parameters SECURITY REQUESTDISPATCHER_FILE_DISCLOSURE 52 Medium

waffle.servlet.ImpersonateTest

Bug Category Details Line Priority
Method waffle.servlet.ImpersonateTest.testImpersonateDisabled() appears to call the same method on the same object redundantly PERFORMANCE PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS 168 High
Method waffle.servlet.ImpersonateTest.testImpersonateEnabled() appears to call the same method on the same object redundantly PERFORMANCE PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS 122 High

waffle.servlet.NegotiateSecurityFilterTest

Bug Category Details Line Priority
Method waffle.servlet.NegotiateSecurityFilterTest.testChallengeGET() accesses list or array with constant index CORRECTNESS CLI_CONSTANT_LIST_INDEX 95 Medium
Method waffle.servlet.NegotiateSecurityFilterTest.testChallengeGET() accesses list or array with constant index CORRECTNESS CLI_CONSTANT_LIST_INDEX 96 Medium

waffle.servlet.WindowsPrincipalTest

Bug Category Details Line Priority
Object deserialization is used in waffle.servlet.WindowsPrincipalTest.testIsSerializable() SECURITY OBJECT_DESERIALIZATION 61 High

waffle.util.AuthorizationHeaderTest

Bug Category Details Line Priority
Method waffle.util.AuthorizationHeaderTest.testGetSecurityPackage() appears to call the same method on the same object redundantly PERFORMANCE PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS 61 Medium
Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1Message() appears to call the same method on the same object redundantly PERFORMANCE PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS 73 Medium
Method waffle.util.AuthorizationHeaderTest.testIsNtlmType1PostAuthorizationHeader() appears to call the same method on the same object redundantly PERFORMANCE PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS 92 Medium
Method waffle.util.AuthorizationHeaderTest.testIsSPNegoPostAuthorizationHeader() appears to call the same method on the same object redundantly PERFORMANCE PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS 128 Medium

waffle.windows.auth.WindowsAuthProviderTest

Bug Category Details Line Priority
Method waffle.windows.auth.WindowsAuthProviderTest.testImpersonateLoggedOnUser() appears to call the same method on the same object redundantly PERFORMANCE PRMC_POSSIBLY_REDUNDANT_METHOD_CALLS 98 High
Format should be constant. Use placeholder to reduce the needless cost of parameter construction. see http://www.slf4j.org/faq.html#logging_performance CORRECTNESS SLF4J_FORMAT_SHOULD_BE_CONST 182 High
Format should be constant. Use placeholder to reduce the needless cost of parameter construction. see http://www.slf4j.org/faq.html#logging_performance CORRECTNESS SLF4J_FORMAT_SHOULD_BE_CONST 289 High
To make log readable, log format ({}) should contain non-sign character. BAD_PRACTICE SLF4J_SIGN_ONLY_FORMAT 112 Medium
To make log readable, log format ({}) should contain non-sign character. BAD_PRACTICE SLF4J_SIGN_ONLY_FORMAT 114 Medium
To make log readable, log format ({}) should contain non-sign character. BAD_PRACTICE SLF4J_SIGN_ONLY_FORMAT 115 Medium
To make log readable, log format ( {}) should contain non-sign character. BAD_PRACTICE SLF4J_SIGN_ONLY_FORMAT 120 Medium
To make log readable, log format ({}: {}) should contain non-sign character. BAD_PRACTICE SLF4J_SIGN_ONLY_FORMAT 137 Medium
To make log readable, log format ( {}) should contain non-sign character. BAD_PRACTICE SLF4J_SIGN_ONLY_FORMAT 184 Medium
To make log readable, log format ( {}) should contain non-sign character. BAD_PRACTICE SLF4J_SIGN_ONLY_FORMAT 291 Medium