"GitLab Advanced SAST rules: Java"
- Tier: Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
Rules used by GitLab Advanced SAST to detect vulnerabilities in Java code.
| Rule ID | Rule description | CWE | OWASP Top 10 |
|---|---|---|---|
java-android-crypto-webview-ignore-ssl-certificate-errors-atomic |
Improper certificate validation | CWE-295 | A3:2017, A02:2021 |
java-android-misconfiguration-webview-debugging-atomic |
Active debug code | CWE-489 | A6:2017, A05:2021 |
java-android-misconfiguration-webview-external-storage-atomic |
Exposed dangerous method or function | CWE-749 | A1:2017, A03:2021 |
java-commons-ssrf-httpclient-taint |
Server-Side Request Forgery (SSRF) | CWE-918 | A1:2017, A10:2021 |
java-groovy-cmdi-groovyshell-taint |
Improper control of generation of code ('Code Injection') | CWE-94 | A1:2017, A03:2021 |
java-hibernate-sqli-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-jackson-deserialization-objectmapper-atomic |
Java Unsafe Jackson Deserialization | CWE-502 | A8:2017, A08:2021 |
java-jackson-deserialization-objectmapper-taint |
Deserialization of untrusted data | CWE-502 | A8:2017, A08:2021 |
java-jdbc-sqli-formatted-string-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-jdbc-sqli-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-jdbi-sqli-handle-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-jdo-sqli-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-jms-deserialization-getobject-taint |
Deserialization of untrusted data | CWE-502 | A8:2017, A08:2021 |
java-jpa-sqli-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-lang-accesscontrol-dangerous-permissions-atomic |
Incorrect permission assignment for critical resource | CWE-732 | A5:2017, A01:2021 |
java-lang-accesscontrol-overly-permissive-file-permission-atomic |
Incorrect permission assignment for critical resource | CWE-732 | A5:2017, A01:2021 |
java-lang-accesscontrol-saml-ignore-comments-atomic |
Weak authentication | CWE-1390 | A5:2017, A01:2021 |
java-lang-accesscontrol-webview-allow-file-access-atomic |
External control of file name or path | CWE-73 | A5:2017, A01:2021 |
java-lang-cmdi-FileDisclosureRequestDispatcher-taint |
Files or directories accessible to external parties | CWE-552 | A5:2017, A01:2021 |
java-lang-cmdi-env-injection-taint |
Improper neutralization of special elements used in an OS command ('OS Command Injection') | CWE-78 | A1:2017, A03:2021 |
java-lang-cmdi-processbuilder-taint |
Improper neutralization of special elements used in an OS command ('OS Command Injection') | CWE-78 | A1:2017, A03:2021 |
java-lang-cmdi-runtime-taint |
Improper neutralization of special elements used in an OS command ('OS Command Injection') | CWE-78 | A1:2017, A03:2021 |
java-lang-cmdi-smtp-client-taint |
Improper neutralization of special elements used in a command | CWE-77 | A1:2017, A03:2021 |
java-lang-codei-scriptinjection-taint |
Improper control of generation of code ('Code Injection') | CWE-94 | A1:2017, A03:2021 |
java-lang-codei-unsafe-reflection-taint |
Use of externally-controlled input to select classes or code ('Unsafe Reflection') | CWE-470 | A1:2017, A03:2021 |
java-lang-cors-permissive-cors-injection-taint |
Permissive cross-domain policy with untrusted domains | CWE-942 | A1:2017, A03:2021 |
java-lang-crlfi-cookie-http-response-splitting-taint |
Improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') | CWE-113 | A1:2017, A03:2021 |
java-lang-crlfi-cookie-request-param-to-header-taint |
Improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') | CWE-113 | A1:2017, A03:2021 |
java-lang-crlfi-logs-injection-taint |
Improper output neutralization for logs | CWE-117 | A1:2017, A03:2021 |
java-lang-crypto-blowfish-keysize-atomic |
Inadequate encryption strength | CWE-326 | A3:2017, A02:2021 |
java-lang-crypto-ciperintegrity-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-cipher-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-cipherdesedeinsecure-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-cipherpaddingoracle-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-custom-messagedigest-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-defaulthttpclient-atomic |
Improper certificate validation | CWE-295 | A3:2017, A02:2021 |
java-lang-crypto-des-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-disallow-old-tls-versions-atomic |
Inadequate encryption strength | CWE-326 | A3:2017, A02:2021 |
java-lang-crypto-ftp-insecure-transport-atomic |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-lang-crypto-gcm-nonce-reuse-atomic |
Reusing a nonce, key pair in encryption | CWE-323 | A3:2017, A02:2021 |
java-lang-crypto-hazelcast-symmetric-encryption-atomic |
Inadequate encryption strength | CWE-326 | A3:2017, A02:2021 |
java-lang-crypto-hostnameverifier-atomic |
Improper certificate validation | CWE-295 | A3:2017, A02:2021 |
java-lang-crypto-http-components-request-atomic |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-lang-crypto-httpget-http-request-taint |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-lang-crypto-insecure-random-taint |
Use of cryptographically weak pseudo-random number generator (PRNG) | CWE-338 | A3:2017, A02:2021 |
java-lang-crypto-insufficient-keysize-atomic |
Inadequate encryption strength | CWE-326 | A3:2017, A02:2021 |
java-lang-crypto-jwt-none-algorithm-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-null-cipher-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-rc2-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-rc4-atomic |
Use of a broken or risky cryptographic algorithm | CWE-327 | A3:2017, A02:2021 |
java-lang-crypto-rsanopadding-atomic |
Use of RSA algorithm without OAEP | CWE-780 | A3:2017, A02:2021 |
java-lang-crypto-smtp-insecure-atomic |
Improper validation of certificate with host mismatch | CWE-297 | A3:2017, A02:2021 |
java-lang-crypto-socket-request-unsafe-protocols-atomic |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-lang-crypto-telnet-request-atomic |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-lang-crypto-tls-unsafe-renegotiation-atomic |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-lang-crypto-weak-messagedigest-atomic |
Use of Weak Hash | CWE-328 | A3:2017, A02:2021 |
java-lang-crypto-weaktls-atomic |
Inadequate encryption strength | CWE-326 | A3:2017, A02:2021 |
java-lang-crypto-weaktlsprotocolsslcontext-atomic |
Inadequate encryption strength | CWE-326 | A3:2017, A02:2021 |
java-lang-crypto-x509trustmanager-atomic |
Improper certificate validation | CWE-295 | A3:2017, A02:2021 |
java-lang-deserialization-objectinputstream-taint |
Deserialization of untrusted data | CWE-502 | A8:2017, A08:2021 |
java-lang-deserialization-server-dangerous-object-deserialization-atomic |
Deserialization of untrusted data | CWE-502 | A8:2017, A08:2021 |
java-lang-file-disclosure-model-and-view-taint |
Files or directories accessible to external parties | CWE-552 | A5:2017, A01:2021 |
java-lang-hpp-taint |
Improper neutralization of argument delimiters in a command ('Argument Injection') | CWE-88 | A1:2017, A03:2021 |
java-lang-ldapi-anonymous-atomic |
Missing authentication for critical function (LDAP) | CWE-306 | A2:2017, A07:2021 |
java-lang-ldapi-taint |
Improper neutralization of special elements used in an LDAP query ('LDAP Injection') | CWE-90 | A1:2017, A03:2021 |
java-lang-misconfiguration-bad-hex-conversion-atomic |
Incorrect type conversion or cast | CWE-704 | A6:2017, A04:2021 |
java-lang-misconfiguration-cookie-http-url-connection-atomic |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-lang-misconfiguration-cookie-httponly-atomic |
Sensitive cookie without 'HttpOnly' flag | CWE-1004 | A6:2017, A05:2021 |
java-lang-misconfiguration-cookie-insecure-atomic |
Sensitive cookie in HTTPS session without 'Secure' attribute | CWE-614 | A6:2017, A05:2021 |
java-lang-misconfiguration-cookie-samesite-taint |
Sensitive cookie with improper SameSite attribute | CWE-1275 | A05:2017, A01:2021 |
java-lang-misconfiguration-external-general-entities-true-atomic |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-misconfiguration-normalizeaftervalidation-atomic |
Incorrect behavior order: validate before canonicalize | CWE-180 | A6:2017, A04:2021 |
java-lang-misconfiguration-properties-input-taint |
External control of system or configuration setting | CWE-15 | A6:2017, A04:2021 |
java-lang-misconfiguration-session-manipulation-taint |
Trust boundary violation | CWE-501 | A04:2021, A6:2017 |
java-lang-misconfiguration-strings-modify-after-validation-taint |
Collapse of data into unsafe value | CWE-182 | A6:2017, A04:2021 |
java-lang-overflow-integer-overflow-taint |
Integer overflow or wraparound | CWE-190 | A6:2017, A04:2021 |
java-lang-overflow-integer-underflow-taint |
Integer underflow or wraparound | CWE-191 | A6:2017, A04:2021 |
java-lang-pathtraversal-file-low-taint |
Improper limitation of a pathname to a restricted directory ('Path Traversal') | CWE-22 | A5:2017, A01:2021 |
java-lang-pathtraversal-file-special-taint |
Improper limitation of a pathname to a restricted directory ('Path Traversal') | CWE-22 | A5:2017, A01:2021 |
java-lang-pathtraversal-file-taint |
Improper limitation of a pathname to a restricted directory ('Path Traversal') | CWE-22 | A5:2017, A01:2021 |
java-lang-sqli-connection-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-lang-sqli-external-config-control-taint |
External control of system or configuration setting | CWE-15 | A5:2017, A01:2021 |
java-lang-sqli-second-order-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-lang-ssrf-thirdparty-taint |
Server-Side Request Forgery (SSRF) | CWE-918 | A1:2017, A10:2021 |
java-lang-ssrf-url-taint |
Server-Side Request Forgery (SSRF) | CWE-918 | A1:2017, A10:2021 |
java-lang-ssti-el-taint |
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') | CWE-917 | A1:2017, A03:2021 |
java-lang-ssti-templateinjection-taint |
Improper neutralization of special elements used in a template engine | CWE-1336 | A1:2017, A03:2021 |
java-lang-xpathi-taint |
Improper neutralization of data within XPath expressions ('XPath Injection') | CWE-643 | A1:2017, A03:2021 |
java-lang-xss-reflected-taint |
Improper neutralization of input during web page generation ('Cross-site Scripting') | CWE-79 | A7:2017, A03:2021 |
java-lang-xss-reqparam-to-servlet-writer-taint |
Improper neutralization of input during web page generation ('Cross-site Scripting') | CWE-79 | A1:2017, A03:2021 |
java-lang-xss-stored-taint |
Improper neutralization of input during web page generation ('Cross-site Scripting') | CWE-79 | A7:2017, A03:2021 |
java-lang-xxe-documentbuilderfactory-parse-taint |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-documentbuilderfactory-taint |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-external-parameter-entities-true-atomic |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-saxparserfactory-taint |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-transformerfactory-taint |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-xml-input-factory-atomic |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-xml-streamreader-taint |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-xmldecoder-taint |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-xmlinputfactory-atomic |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-xmlreader-taint |
Improper restriction of XML external entity reference ('XXE') | CWE-611 | A4:2017, A05:2021 |
java-lang-xxe-xslttransform-taint |
XML injection (aka Blind XPath injection) | CWE-91 | A1:2017, A03:2021 |
java-mongodb-nosqli-injection-taint |
Improper neutralization of special elements in data query logic | CWE-943 | A1:2017, A03:2021 |
java-opensymphony-ognli-taint |
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection'). | CWE-917 | A1:2017, A03:2021 |
java-pebble-ssti-literaltemplate-taint |
Improper neutralization of special elements used in a template engine | CWE-1336 | A1:2017, A03:2021 |
java-seam-cmdi-loginjection-taint |
Improper neutralization of directives in dynamically evaluated code ('Eval Injection') | CWE-95 | A1:2017, A03:2021 |
java-snakeyaml-deserialization-yaml-taint |
Deserialization of untrusted data | CWE-502 | A8:2017, A08:2021 |
java-spring-crypto-ftp-request-taint |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-spring-crypto-http-request-resttemplate-taint |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-spring-crypto-jwt-decode-atomic |
Improper verification of cryptographic signature | CWE-347 | A8:2017, A08:2021 |
java-spring-crypto-unirest-http-request-atomic |
Cleartext transmission of sensitive information | CWE-319 | A3:2017, A02:2021 |
java-spring-csrf-spring-csrf-disabled-atomic |
Cross-site request forgery (CSRF) | CWE-352 | A5:2017, A01:2021 |
java-spring-csrf-unrestricted-requestmapping-atomic |
Cross-site request forgery (CSRF) | CWE-352 | A5:2017, A01:2021 |
java-spring-misconfiguration-cookie-httponly-atomic |
Sensitive cookie without 'HttpOnly' flag | CWE-1004 | A06:2017, A05:2021 |
java-spring-misconfiguration-cookie-samesite-atomic |
Sensitive cookie with improper SameSite attribute | CWE-1275 | A05:2017, A01:2021 |
java-spring-misconfiguration-cookie-secure-atomic |
Sensitive cookie in HTTPS session without 'Secure' attribute | CWE-614 | A06:2017, A05:2021 |
java-spring-misconfiguration-frameoptions-atomic |
Improper restriction of rendered UI layers or frames | CWE-1021 | A06:2017, A04:2021 |
java-spring-misconfiguration-nooppasswordencoder-atomic |
Plaintext storage of a password | CWE-256 | A2:2017, A04:2021 |
java-spring-openredirect-unvalidatedredirect-taint |
URL redirection to untrusted site ('Open Redirect') | CWE-601 | A1:2017, A03:2021 |
java-spring-ssti-expressionparser-taint |
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') | CWE-917 | A1:2017, A03:2021 |
java-torque-sqli-basepeer-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-turbine-sqli-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-vertex-sqli-taint |
Improper neutralization of special elements used in an SQL command ('SQL Injection') | CWE-89 | A1:2017, A03:2021 |
java-wicket-xss-escape-false-taint |
Improper neutralization of input during web page generation ('Cross-site Scripting') | CWE-79 | A1:2017, A03:2021 |