SpotBugs Bug Detector Report
The following document contains the results of SpotBugs
SpotBugs Version is 4.10.4
Threshold is medium
Effort is
Summary
| Classes |
Bugs |
Errors |
Missing Classes |
| 20 |
33 |
0 |
0 |
waffle.apache.GenericWindowsPrincipal
| Bug |
Category |
Details |
Line |
Priority |
| waffle.apache.GenericWindowsPrincipal.getGroups() may expose internal representation by returning GenericWindowsPrincipal.groups |
MALICIOUS_CODE |
EI_EXPOSE_REP |
100 |
Medium |
| waffle.apache.GenericWindowsPrincipal doesn't override org.apache.catalina.realm.GenericPrincipal.equals(Object) |
STYLE |
EQ_DOESNT_OVERRIDE_EQUALS |
1 |
Medium |
| Class waffle.apache.GenericWindowsPrincipal 'overloads' a method with both instance and static versions |
STYLE |
MOM_MISLEADING_OVERLOAD_MODEL |
100 |
Medium |
| Method waffle.apache.GenericWindowsPrincipal.getGroups(IWindowsAccount[]) does not presize the allocation of a collection |
PERFORMANCE |
PSC_PRESIZE_COLLECTIONS |
89 |
Medium |
waffle.apache.MixedAuthenticator
| Bug |
Category |
Details |
Line |
Priority |
| Unconstrained method waffle.apache.MixedAuthenticator.redirectTo(Request, HttpServletResponse, String) converts checked exception to unchecked |
STYLE |
EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS |
280 |
High |
| Format should be constant. Use placeholder to reduce the needless cost of parameter construction. see http://www.slf4j.org/faq.html#logging_performance |
CORRECTNESS |
SLF4J_FORMAT_SHOULD_BE_CONST |
230 |
High |
| To make log readable, log format () should contain non-sign character. |
BAD_PRACTICE |
SLF4J_SIGN_ONLY_FORMAT |
148 |
Medium |
| To make log readable, log format () should contain non-sign character. |
BAD_PRACTICE |
SLF4J_SIGN_ONLY_FORMAT |
170 |
Medium |
| To make log readable, log format () should contain non-sign character. |
BAD_PRACTICE |
SLF4J_SIGN_ONLY_FORMAT |
231 |
Medium |
waffle.apache.MixedAuthenticatorTest
| Bug |
Category |
Details |
Line |
Priority |
| Method waffle.apache.MixedAuthenticatorTest.testChallengeGET() accesses list or array with constant index |
CORRECTNESS |
CLI_CONSTANT_LIST_INDEX |
103 |
Medium |
waffle.apache.NegotiateAuthenticator
| Bug |
Category |
Details |
Line |
Priority |
| method waffle.apache.NegotiateAuthenticator.authenticate(Request, HttpServletResponse) converts an exception into a boolean 'error code' value |
STYLE |
EXS_EXCEPTION_SOFTENING_RETURN_FALSE |
97 |
Medium |
| To make log readable, log format () should contain non-sign character. |
BAD_PRACTICE |
SLF4J_SIGN_ONLY_FORMAT |
95 |
Medium |
| To make log readable, log format () should contain non-sign character. |
BAD_PRACTICE |
SLF4J_SIGN_ONLY_FORMAT |
117 |
Medium |
waffle.apache.NegotiateAuthenticatorTest
| Bug |
Category |
Details |
Line |
Priority |
| Method waffle.apache.NegotiateAuthenticatorTest.testChallengeGET() accesses list or array with constant index |
CORRECTNESS |
CLI_CONSTANT_LIST_INDEX |
105 |
Medium |
waffle.apache.WaffleAuthenticatorBase
| Bug |
Category |
Details |
Line |
Priority |
| Shared primitive variable "allowGuestLogin" in one thread may not yield the value of the most recent write from another thread |
MT_CORRECTNESS |
AT_STALE_THREAD_WRITE_OF_PRIMITIVE |
166 |
Medium |
| Shared primitive variable "continueContextsTimeout" in one thread may not yield the value of the most recent write from another thread |
MT_CORRECTNESS |
AT_STALE_THREAD_WRITE_OF_PRIMITIVE |
78 |
Medium |
| Unconstrained method waffle.apache.WaffleAuthenticatorBase.sendError(HttpServletResponse, int) converts checked exception to unchecked |
STYLE |
EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS |
223 |
High |
| Unconstrained method waffle.apache.WaffleAuthenticatorBase.sendUnauthorized(HttpServletResponse) converts checked exception to unchecked |
STYLE |
EXS_EXCEPTION_SOFTENING_NO_CONSTRAINTS |
207 |
High |
| Format should be constant. Use placeholder to reduce the needless cost of parameter construction. see http://www.slf4j.org/faq.html#logging_performance |
CORRECTNESS |
SLF4J_FORMAT_SHOULD_BE_CONST |
240 |
High |
|
Logger should be final field. Change this field (log) to final field.
|
STYLE |
SLF4J_LOGGER_SHOULD_BE_FINAL |
Not available |
Medium |
|
To prevent illegal usage, logger should be private field. Change this field (log) to private field.
|
STYLE |
SLF4J_LOGGER_SHOULD_BE_PRIVATE |
Not available |
Medium |
| To make log readable, log format () should contain non-sign character. |
BAD_PRACTICE |
SLF4J_SIGN_ONLY_FORMAT |
241 |
Medium |
waffle.apache.WaffleAuthenticatorBaseTest$1
| Bug |
Category |
Details |
Line |
Priority |
| Non derivable method waffle.apache.WaffleAuthenticatorBaseTest$1.authenticate(Request, HttpServletResponse) declares throwing an exception that isn't thrown |
CORRECTNESS |
BED_BOGUS_EXCEPTION_DECLARATION |
39 |
Medium |
| Non derivable method waffle.apache.WaffleAuthenticatorBaseTest$1.doAuthenticate(Request, HttpServletResponse) declares throwing an exception that isn't thrown |
CORRECTNESS |
BED_BOGUS_EXCEPTION_DECLARATION |
45 |
Medium |
waffle.apache.WindowsAccountTest
| Bug |
Category |
Details |
Line |
Priority |
| Object deserialization is used in waffle.apache.WindowsAccountTest.testIsSerializable() |
SECURITY |
OBJECT_DESERIALIZATION |
73 |
High |
waffle.apache.catalina.SimpleHttpRequest
| Bug |
Category |
Details |
Line |
Priority |
| waffle.apache.catalina.SimpleHttpRequest.getSession() may expose internal representation by returning SimpleHttpRequest.httpSession |
MALICIOUS_CODE |
EI_EXPOSE_REP |
156 |
Medium |
| waffle.apache.catalina.SimpleHttpRequest.getSession(boolean) may expose internal representation by returning SimpleHttpRequest.httpSession |
MALICIOUS_CODE |
EI_EXPOSE_REP |
161 |
Medium |
| This method waffle.apache.catalina.SimpleHttpRequest.setQueryString(String) parses a String that is a field |
STYLE |
STT_STRING_PARSING_A_FIELD |
198 |
Medium |
| Static synchronized method waffle.apache.catalina.SimpleHttpRequest.nextRemotePort() uses intrinsic lock of class waffle.apache.catalina.SimpleHttpRequest for synchronization, exposing the class to untrusted code. |
SECURITY |
USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION |
33 |
Medium |
| Static synchronized method waffle.apache.catalina.SimpleHttpRequest.resetRemotePort() uses intrinsic lock of class waffle.apache.catalina.SimpleHttpRequest for synchronization, exposing the class to untrusted code. |
SECURITY |
USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION |
40-41 |
Medium |
waffle.apache.catalina.SimpleHttpResponse
| Bug |
Category |
Details |
Line |
Priority |
| To make log readable, log format ({} {}) should contain non-sign character. |
BAD_PRACTICE |
SLF4J_SIGN_ONLY_FORMAT |
45 |
Medium |
| To make log readable, log format ({}: {}) should contain non-sign character. |
BAD_PRACTICE |
SLF4J_SIGN_ONLY_FORMAT |
48 |
Medium |
| waffle.apache.catalina.SimpleHttpResponse.flushBuffer() makes inefficient use of keySet iterator instead of entrySet iterator |
PERFORMANCE |
WMI_WRONG_MAP_ITERATOR |
47 |
Medium |
