\n }\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 54
},
"region": {
"startLine": 388,
"startColumn": 2,
"endLine": 391
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function createContent() in [AccessControlMatrix.java](1) might reveal system data or debugging information by calling printStackTrace() on line [114](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 105
},
"region": {
"startLine": 114,
"snippet": {
"text": "\t\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 111,
"endLine": 117,
"snippet": {
"text": "\t\tcatch (Exception e)\n\t\t{\n\t\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t\t e.printStackTrace();\n\t\t}\n\t\n\t\treturn (ec);\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 105
},
"region": {
"startLine": 114,
"snippet": {
"text": "\t\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 111,
"endLine": 117,
"snippet": {
"text": "\t\tcatch (Exception e)\n\t\t{\n\t\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t\t e.printStackTrace();\n\t\t}\n\t\n\t\treturn (ec);\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 105
},
"region": {
"startLine": 114
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 125,
"level": "error",
"message": {
"text": "The method _jspService() in [ViewProfile.jsp](1) mishandles confidential information, which can compromise user privacy and is often illegal.\r\nMishandling private information, such as customer passwords or social security numbers, can compromise user privacy and is often illegal."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 44
},
"region": {
"startLine": 54,
"snippet": {
"text": "\t\t\t \t\t<%=employee.getSsn()%>"
}
},
"contextRegion": {
"startLine": 51,
"endLine": 57,
"snippet": {
"text": "\t\t\t \t\tSSN: \n\t\t\t \t\n\t\t\t \t| \n\t\t\t \t\t<%=employee.getSsn()%>\n\t\t\t\t\t | \n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\tSalary: \n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 497
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 44
},
"region": {
"startLine": 54,
"snippet": {
"text": "\t\t\t \t\t<%=employee.getSsn()%>"
}
},
"contextRegion": {
"startLine": 51,
"endLine": 57,
"snippet": {
"text": "\t\t\t \t\tSSN: \n\t\t\t \t | \n\t\t\t \t\n\t\t\t \t\t<%=employee.getSsn()%>\n\t\t\t\t\t | \n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\tSalary: \n"
}
}
},
"message": {
"text": "print(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 44
},
"region": {
"startLine": 54
}
}
}
],
"properties": {
"InstanceSeverity": "4.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function hashSHA() in [Encoding.java](1) might reveal system data or debugging information by calling printStackTrace() on line [672](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 672,
"snippet": {
"text": "\t\t\te.printStackTrace();"
}
},
"contextRegion": {
"startLine": 669,
"endLine": 675,
"snippet": {
"text": "\t\tcatch ( NoSuchAlgorithmException e )\n\t\t{\n\t\t\t// it's got to be there\n\t\t\te.printStackTrace();\n\t\t}\n\t\treturn ( base64Encode( md.digest() ) );\n\t}\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 672,
"snippet": {
"text": "\t\t\te.printStackTrace();"
}
},
"contextRegion": {
"startLine": 669,
"endLine": 675,
"snippet": {
"text": "\t\tcatch ( NoSuchAlgorithmException e )\n\t\t{\n\t\t\t// it's got to be there\n\t\t\te.printStackTrace();\n\t\t}\n\t\treturn ( base64Encode( md.digest() ) );\n\t}\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 672
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function getEmployeeProfile() in [ViewProfile.java](1) might reveal system data or debugging information by calling printStackTrace() on line [140](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 53
},
"region": {
"startLine": 140,
"snippet": {
"text": "\t\tsqle.printStackTrace();"
}
},
"contextRegion": {
"startLine": 137,
"endLine": 143,
"snippet": {
"text": "\t catch (SQLException sqle)\n\t {\n\t\ts.setMessage(\"Error getting employee profile\");\n\t\tsqle.printStackTrace();\n\t }\n\t}\n\tcatch (Exception e)\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 53
},
"region": {
"startLine": 140,
"snippet": {
"text": "\t\tsqle.printStackTrace();"
}
},
"contextRegion": {
"startLine": 137,
"endLine": 143,
"snippet": {
"text": "\t catch (SQLException sqle)\n\t {\n\t\ts.setMessage(\"Error getting employee profile\");\n\t\tsqle.printStackTrace();\n\t }\n\t}\n\tcatch (Exception e)\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 53
},
"region": {
"startLine": 140
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 42,
"message": {
"text": "The method doPost() in [HammerHead.java](1) commingles trusted and untrusted data in the same data structure, which encourages programmers to mistakenly trust unvalidated data.\r\nCommingling trusted and untrusted data in the same data structure encourages programmers to mistakenly trust unvalidated data."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 184,
"snippet": {
"text": "\t request.getSession().setAttribute(\"websession\", mySession);"
}
},
"contextRegion": {
"startLine": 181,
"endLine": 187,
"snippet": {
"text": "\t\tclientBrowser = userAgent;\n\t }\n\t request.setAttribute(\"client.browser\", clientBrowser);\n\t request.getSession().setAttribute(\"websession\", mySession);\n\t request.getSession().setAttribute(\"course\", mySession.getCourse());\n\n\t request.getRequestDispatcher(getViewPage(mySession)).forward(\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 503
},
{
"index": 504
},
{
"index": 505
},
{
"index": 135
},
{
"index": 157
},
{
"index": 506
},
{
"index": 159
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 184,
"snippet": {
"text": "\t request.getSession().setAttribute(\"websession\", mySession);"
}
},
"contextRegion": {
"startLine": 181,
"endLine": 187,
"snippet": {
"text": "\t\tclientBrowser = userAgent;\n\t }\n\t request.setAttribute(\"client.browser\", clientBrowser);\n\t request.getSession().setAttribute(\"websession\", mySession);\n\t request.getSession().setAttribute(\"course\", mySession.getCourse());\n\n\t request.getRequestDispatcher(getViewPage(mySession)).forward(\n"
}
}
},
"message": {
"text": "setAttribute(1)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
},
{
"threadFlows": [
{
"locations": [
{
"index": 503
},
{
"index": 504
},
{
"index": 505
},
{
"index": 135
},
{
"index": 179
},
{
"index": 180
},
{
"index": 181
},
{
"index": 182
},
{
"index": 183
},
{
"index": 157
},
{
"index": 506
},
{
"index": 159
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 184,
"snippet": {
"text": "\t request.getSession().setAttribute(\"websession\", mySession);"
}
},
"contextRegion": {
"startLine": 181,
"endLine": 187,
"snippet": {
"text": "\t\tclientBrowser = userAgent;\n\t }\n\t request.setAttribute(\"client.browser\", clientBrowser);\n\t request.getSession().setAttribute(\"websession\", mySession);\n\t request.getSession().setAttribute(\"course\", mySession.getCourse());\n\n\t request.getRequestDispatcher(getViewPage(mySession)).forward(\n"
}
}
},
"message": {
"text": "setAttribute(1)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 184
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [ParameterParser.java](1) line [298](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 298,
"endLine": 301,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t return def;\r\n\t}"
}
},
"contextRegion": {
"startLine": 295,
"endLine": 304,
"snippet": {
"text": "\t{\n\t return getDoubleParameter(name);\n\t}\n\tcatch (Exception e)\n\t{\n\t return def;\n\t}\n }\n\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 298,
"endLine": 301,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t return def;\r\n\t}"
}
},
"contextRegion": {
"startLine": 295,
"endLine": 304,
"snippet": {
"text": "\t{\n\t return getDoubleParameter(name);\n\t}\n\tcatch (Exception e)\n\t{\n\t return def;\n\t}\n }\n\n\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 298,
"startColumn": 2,
"endLine": 301
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [UserTracker.java](1) line [161](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 98
},
"region": {
"startLine": 161,
"endLine": 162,
"snippet": {
"text": "\t catch (Exception e)\r\n\t {}"
}
},
"contextRegion": {
"startLine": 158,
"endLine": 165,
"snippet": {
"text": "\t\tusersDB.close();\n\n\t }\n\t catch (Exception e)\n\t {}\n\t}\n }\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 98
},
"region": {
"startLine": 161,
"endLine": 162,
"snippet": {
"text": "\t catch (Exception e)\r\n\t {}"
}
},
"contextRegion": {
"startLine": 158,
"endLine": 165,
"snippet": {
"text": "\t\tusersDB.close();\n\n\t }\n\t catch (Exception e)\n\t {}\n\t}\n }\n\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 98
},
"region": {
"startLine": 161,
"startColumn": 6,
"endLine": 162
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function deleteEmployeeProfile() in [DeleteProfile.java](1) might reveal system data or debugging information by calling printStackTrace() on line [120](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 73
},
"region": {
"startLine": 120,
"snippet": {
"text": "\t\tsqle.printStackTrace();"
}
},
"contextRegion": {
"startLine": 117,
"endLine": 123,
"snippet": {
"text": "\t catch (SQLException sqle)\n\t {\n\t\ts.setMessage(\"Error deleting employee profile\");\n\t\tsqle.printStackTrace();\n\t }\n\t}\n\tcatch (Exception e)\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 73
},
"region": {
"startLine": 120,
"snippet": {
"text": "\t\tsqle.printStackTrace();"
}
},
"contextRegion": {
"startLine": 117,
"endLine": 123,
"snippet": {
"text": "\t catch (SQLException sqle)\n\t {\n\t\ts.setMessage(\"Error deleting employee profile\");\n\t\tsqle.printStackTrace();\n\t }\n\t}\n\tcatch (Exception e)\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 73
},
"region": {
"startLine": 120
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function isAuthorized() in [AbstractLesson.java](1) might reveal system data or debugging information by calling printStackTrace() on line [813](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 75
},
"region": {
"startLine": 813,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 810,
"endLine": 816,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error authorizing\");\n\t e.printStackTrace();\n\t}\n\treturn authorized;\n }\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 75
},
"region": {
"startLine": 813,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 810,
"endLine": 816,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error authorizing\");\n\t e.printStackTrace();\n\t}\n\treturn authorized;\n }\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 75
},
"region": {
"startLine": 813
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [SqlStringInjection.java](1) line [219](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 13
},
"region": {
"startLine": 219,
"endLine": 223,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\r\n\t e.printStackTrace();\r\n\t}"
}
},
"contextRegion": {
"startLine": 216,
"endLine": 226,
"snippet": {
"text": "\t\tec.addElement(new P().addElement(sqle.getMessage()));\n\t }\n\t}\n\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\n\treturn (ec);\n }\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 13
},
"region": {
"startLine": 219,
"endLine": 223,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\r\n\t e.printStackTrace();\r\n\t}"
}
},
"contextRegion": {
"startLine": 216,
"endLine": 226,
"snippet": {
"text": "\t\tec.addElement(new P().addElement(sqle.getMessage()));\n\t }\n\t}\n\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\n\treturn (ec);\n }\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 13
},
"region": {
"startLine": 219,
"startColumn": 2,
"endLine": 223
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 24,
"level": "error",
"message": {
"text": "The method writeTable() in [DatabaseUtilities.java](1) sends unvalidated data to a web browser on line [154](1), which can result in the browser executing malicious code.\r\nSending unvalidated data to a web browser can result in the browser executing malicious code."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 17
},
"region": {
"startLine": 154,
"snippet": {
"text": "\t\t row.addElement(new TD(results.getString(i).replaceAll(\" \","
}
},
"contextRegion": {
"startLine": 151,
"endLine": 157,
"snippet": {
"text": "\n\t\tfor (int i = 1; i < (numColumns + 1); i++)\n\t\t{\n\t\t row.addElement(new TD(results.getString(i).replaceAll(\" \",\n\t\t\t \" \")));\n\t\t}\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 513
},
{
"index": 514
},
{
"index": 515
},
{
"index": 65
},
{
"index": 66
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 17
},
"region": {
"startLine": 154,
"snippet": {
"text": "\t\t row.addElement(new TD(results.getString(i).replaceAll(\" \","
}
},
"contextRegion": {
"startLine": 151,
"endLine": 157,
"snippet": {
"text": "\n\t\tfor (int i = 1; i < (numColumns + 1); i++)\n\t\t{\n\t\t row.addElement(new TD(results.getString(i).replaceAll(\" \",\n\t\t\t \" \")));\n\t\t}\n\n"
}
}
},
"message": {
"text": "TD(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 17
},
"region": {
"startLine": 154
}
}
}
],
"properties": {
"InstanceSeverity": "4.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 62,
"level": "error",
"message": {
"text": "The method createContent() in [BlindSqlInjection.java](1) sends unvalidated data to a web browser on line [83](1), which can result in the browser executing malicious code.\r\nSending unvalidated data to a web browser can result in the browser executing malicious code."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 70
},
"region": {
"startLine": 83,
"snippet": {
"text": "\t\t .toString());"
}
},
"contextRegion": {
"startLine": 80,
"endLine": 86,
"snippet": {
"text": "\t String accountNumber = s.getParser().getRawParameter(ACCT_NUM,\n\t\t \"101\");\n\t Input input = new Input(Input.TEXT, ACCT_NUM, accountNumber\n\t\t .toString());\n\t ec.addElement(input);\n\n\t Element b = ECSFactory.makeButton(\"Go!\");\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 0
},
{
"index": 2
},
{
"index": 3
},
{
"index": 7
},
{
"index": 10
},
{
"index": 487
},
{
"index": 488
},
{
"index": 489
},
{
"index": 522
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 70
},
"region": {
"startLine": 83,
"snippet": {
"text": "\t\t .toString());"
}
},
"contextRegion": {
"startLine": 80,
"endLine": 86,
"snippet": {
"text": "\t String accountNumber = s.getParser().getRawParameter(ACCT_NUM,\n\t\t \"101\");\n\t Input input = new Input(Input.TEXT, ACCT_NUM, accountNumber\n\t\t .toString());\n\t ec.addElement(input);\n\n\t Element b = ECSFactory.makeButton(\"Go!\");\n"
}
}
},
"message": {
"text": "Input(2)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 70
},
"region": {
"startLine": 83
}
}
}
],
"properties": {
"InstanceSeverity": "4.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function parameterizedQuery() in [SqlNumericInjection.java](1) might reveal system data or debugging information by calling printStackTrace() on line [242](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 65
},
"region": {
"startLine": 242,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 239,
"endLine": 245,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\n\treturn (ec);\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 65
},
"region": {
"startLine": 242,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 239,
"endLine": 245,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\n\treturn (ec);\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 65
},
"region": {
"startLine": 242
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 108,
"level": "error",
"message": {
"text": "The method getStringParameter() in [ParameterParser.java](1) mishandles confidential information, which can compromise user privacy and is often illegal.\r\nMishandling private information, such as customer passwords or social security numbers, can compromise user privacy and is often illegal."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 699,
"snippet": {
"text": "\t throw new ParameterNotFoundException(name + \" was empty\");"
}
},
"contextRegion": {
"startLine": 696,
"endLine": 702,
"snippet": {
"text": "\t}\n\telse if (values[0].length() == 0)\n\t{\n\t throw new ParameterNotFoundException(name + \" was empty\");\n\t}\n\telse\n\t{\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 1
},
{
"index": 8
},
{
"index": 9
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 699,
"snippet": {
"text": "\t throw new ParameterNotFoundException(name + \" was empty\");"
}
},
"contextRegion": {
"startLine": 696,
"endLine": 702,
"snippet": {
"text": "\t}\n\telse if (values[0].length() == 0)\n\t{\n\t throw new ParameterNotFoundException(name + \" was empty\");\n\t}\n\telse\n\t{\n"
}
}
},
"message": {
"text": "ParameterNotFoundException(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 699
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 100,
"message": {
"text": "The servlet Controller fails to catch all exceptions in doPost(). If a Servlet fails to catch all exceptions, it might reveal debugging information that will help an adversary form a plan of attack.\r\nIf a Servlet fails to catch all exceptions, it might reveal debugging information that will help an adversary form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 61
},
"region": {
"startLine": 60,
"snippet": {
"text": " protected void doPost(HttpServletRequest request,"
}
},
"contextRegion": {
"startLine": 57,
"endLine": 63,
"snippet": {
"text": " }\n\n\n protected void doPost(HttpServletRequest request,\n\t HttpServletResponse response) throws ServletException, IOException\n\n {\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 61
},
"region": {
"startLine": 60,
"snippet": {
"text": " protected void doPost(HttpServletRequest request,"
}
},
"contextRegion": {
"startLine": 57,
"endLine": 63,
"snippet": {
"text": " }\n\n\n protected void doPost(HttpServletRequest request,\n\t HttpServletResponse response) throws ServletException, IOException\n\n {\n"
}
}
},
"message": {
"text": "Function: doPost"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 61
},
"region": {
"startLine": 60
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function handleRequest() in [Logout.java](1) might reveal system data or debugging information by calling printStackTrace() on line [71](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 9
},
"region": {
"startLine": 71,
"snippet": {
"text": "\t ue1.printStackTrace();"
}
},
"contextRegion": {
"startLine": 68,
"endLine": 74,
"snippet": {
"text": "\tcatch (UnauthenticatedException ue1)\n\t{\n\t System.out.println(\"Internal server error\");\n\t ue1.printStackTrace();\n\t}\n\tcatch (UnauthorizedException ue2)\n\t{\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 9
},
"region": {
"startLine": 71,
"snippet": {
"text": "\t ue1.printStackTrace();"
}
},
"contextRegion": {
"startLine": 68,
"endLine": 74,
"snippet": {
"text": "\tcatch (UnauthenticatedException ue1)\n\t{\n\t System.out.println(\"Internal server error\");\n\t ue1.printStackTrace();\n\t}\n\tcatch (UnauthorizedException ue2)\n\t{\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 9
},
"region": {
"startLine": 71
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 47,
"level": "note",
"message": {
"text": "The method checkCookie() in [WeakAuthenticationCookie.java](1) throws a generic exception making it harder for callers to do a good job of error handling and recovery.\r\nThe method throws a generic exception making it harder for callers to do a good job of error handling and recovery."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 132
},
"region": {
"startLine": 85,
"snippet": {
"text": " protected String checkCookie(WebSession s) throws Exception"
}
},
"contextRegion": {
"startLine": 82,
"endLine": 88,
"snippet": {
"text": " * @return Description of the Return Value\n * @exception Exception Description of the Exception\n */\n protected String checkCookie(WebSession s) throws Exception\n {\n\tString cookie = getCookie(s);\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 132
},
"region": {
"startLine": 85,
"snippet": {
"text": " protected String checkCookie(WebSession s) throws Exception"
}
},
"contextRegion": {
"startLine": 82,
"endLine": 88,
"snippet": {
"text": " * @return Description of the Return Value\n * @exception Exception Description of the Exception\n */\n protected String checkCookie(WebSession s) throws Exception\n {\n\tString cookie = getCookie(s);\n\n"
}
}
},
"message": {
"text": "Function: checkCookie"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 132
},
"region": {
"startLine": 85
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 32,
"level": "note",
"message": {
"text": "The class UserTracker contains a field and a method both named instance, which is confusing.\r\nThe class contains a field and a method with the same name."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 98
},
"region": {
"startLine": 49,
"snippet": {
"text": " private static UserTracker instance;"
}
},
"contextRegion": {
"startLine": 46,
"endLine": 52,
"snippet": {
"text": "public class UserTracker\n{\n\n private static UserTracker instance;\n\n // FIXME: persist this somehow!\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 98
},
"region": {
"startLine": 49,
"snippet": {
"text": " private static UserTracker instance;"
}
},
"contextRegion": {
"startLine": 46,
"endLine": 52,
"snippet": {
"text": "public class UserTracker\n{\n\n private static UserTracker instance;\n\n // FIXME: persist this somehow!\n\n"
}
}
},
"message": {
"text": "Field: instance"
}
},
"kinds": [
"unknown"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 98
},
"region": {
"startLine": 240,
"snippet": {
"text": " public static synchronized UserTracker instance()"
}
},
"contextRegion": {
"startLine": 237,
"endLine": 243,
"snippet": {
"text": " *\n * @return Description of the Return Value\n */\n public static synchronized UserTracker instance()\n {\n\n\tif (instance == null)\n"
}
}
},
"message": {
"text": "Function: instance"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 98
},
"region": {
"startLine": 49
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 47,
"level": "note",
"message": {
"text": "The method doStage2() in [LessonAdapter.java](1) throws a generic exception making it harder for callers to do a good job of error handling and recovery.\r\nThe method throws a generic exception making it harder for callers to do a good job of error handling and recovery."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 116
},
"region": {
"startLine": 152,
"snippet": {
"text": " protected Element doStage2(WebSession s) throws Exception"
}
},
"contextRegion": {
"startLine": 149,
"endLine": 155,
"snippet": {
"text": " }\n\n\n protected Element doStage2(WebSession s) throws Exception\n {\n\tElementContainer ec = new ElementContainer();\n\tec.addElement(\"Stage 2 Stub\");\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 116
},
"region": {
"startLine": 152,
"snippet": {
"text": " protected Element doStage2(WebSession s) throws Exception"
}
},
"contextRegion": {
"startLine": 149,
"endLine": 155,
"snippet": {
"text": " }\n\n\n protected Element doStage2(WebSession s) throws Exception\n {\n\tElementContainer ec = new ElementContainer();\n\tec.addElement(\"Stage 2 Stub\");\n"
}
}
},
"message": {
"text": "Function: doStage2"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 116
},
"region": {
"startLine": 152
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 62,
"level": "error",
"message": {
"text": "The method makeRequestDump_DELETEME() in [AbstractLesson.java](1) sends unvalidated data to a web browser on line [920](1), which can result in the browser executing malicious code.\r\nSending unvalidated data to a web browser can result in the browser executing malicious code."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 75
},
"region": {
"startLine": 920,
"snippet": {
"text": "\t\tec)));"
}
},
"contextRegion": {
"startLine": 917,
"endLine": 923,
"snippet": {
"text": "\t}\n\n\tt.addElement(new TR().addElement(new TD().setVAlign(\"TOP\").addElement(\n\t\tec)));\n\n\treturn (t);\n }\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 529
},
{
"index": 530
},
{
"index": 538
},
{
"index": 539
},
{
"index": 540
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 75
},
"region": {
"startLine": 920,
"snippet": {
"text": "\t\tec)));"
}
},
"contextRegion": {
"startLine": 917,
"endLine": 923,
"snippet": {
"text": "\t}\n\n\tt.addElement(new TR().addElement(new TD().setVAlign(\"TOP\").addElement(\n\t\tec)));\n\n\treturn (t);\n }\n"
}
}
},
"message": {
"text": "addElement(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 75
},
"region": {
"startLine": 920,
"startColumn": 3
}
}
}
],
"properties": {
"InstanceSeverity": "4.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function getAllEmployees() in [Login.java](1) might reveal system data or debugging information by calling printStackTrace() on line [216](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 37
},
"region": {
"startLine": 216,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 213,
"endLine": 219,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error getting employees\");\n\t e.printStackTrace();\n\t}\n\n\treturn employees;\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 37
},
"region": {
"startLine": 216,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 213,
"endLine": 219,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error getting employees\");\n\t e.printStackTrace();\n\t}\n\n\treturn employees;\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 37
},
"region": {
"startLine": 216
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 108,
"level": "error",
"message": {
"text": "The method getRawParameter() in [ParameterParser.java](1) mishandles confidential information, which can compromise user privacy and is often illegal.\r\nMishandling private information, such as customer passwords or social security numbers, can compromise user privacy and is often illegal."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 631,
"snippet": {
"text": "\t throw new ParameterNotFoundException(name + \" not found\");"
}
},
"contextRegion": {
"startLine": 628,
"endLine": 634,
"snippet": {
"text": "\n\tif (values == null)\n\t{\n\t throw new ParameterNotFoundException(name + \" not found\");\n\t}\n\telse if (values[0].length() == 0)\n\t{\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 541
},
{
"index": 542
},
{
"index": 128
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 631,
"snippet": {
"text": "\t throw new ParameterNotFoundException(name + \" not found\");"
}
},
"contextRegion": {
"startLine": 628,
"endLine": 634,
"snippet": {
"text": "\n\tif (values == null)\n\t{\n\t throw new ParameterNotFoundException(name + \" not found\");\n\t}\n\telse if (values[0].length() == 0)\n\t{\n"
}
}
},
"message": {
"text": "ParameterNotFoundException(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 631
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 99,
"message": {
"text": "Without proper access control, the method findEmployeeProfile() in [FindProfile.java](1) can execute a SQL statement on line [145](1) that contains an attacker-controlled primary key, thereby allowing the attacker to access unauthorized records.\r\nWithout proper access control, executing a SQL statement that contains a user-controlled primary key can allow an attacker to view unauthorized records."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 93
},
"region": {
"startLine": 145,
"snippet": {
"text": "\t\tanswer_statement.setString(2, \"%\" + pattern + \"%\");"
}
},
"contextRegion": {
"startLine": 142,
"endLine": 148,
"snippet": {
"text": "\t\t\t\tResultSet.TYPE_SCROLL_INSENSITIVE,\n\t\t\t\tResultSet.CONCUR_READ_ONLY);\n\t\tanswer_statement.setString(1, \"%\" + pattern + \"%\");\n\t\tanswer_statement.setString(2, \"%\" + pattern + \"%\");\n\t\tResultSet answer_results = answer_statement.executeQuery();\n\n\t\t// Just use the first hit.\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 0
},
{
"index": 2
},
{
"index": 3
},
{
"index": 525
},
{
"index": 526
},
{
"index": 527
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 93
},
"region": {
"startLine": 145,
"snippet": {
"text": "\t\tanswer_statement.setString(2, \"%\" + pattern + \"%\");"
}
},
"contextRegion": {
"startLine": 142,
"endLine": 148,
"snippet": {
"text": "\t\t\t\tResultSet.TYPE_SCROLL_INSENSITIVE,\n\t\t\t\tResultSet.CONCUR_READ_ONLY);\n\t\tanswer_statement.setString(1, \"%\" + pattern + \"%\");\n\t\tanswer_statement.setString(2, \"%\" + pattern + \"%\");\n\t\tResultSet answer_results = answer_statement.executeQuery();\n\n\t\t// Just use the first hit.\n"
}
}
},
"message": {
"text": "setString(1)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 93
},
"region": {
"startLine": 145
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function getUserName() in [DefaultLessonAction.java](1) might reveal system data or debugging information by calling printStackTrace() on line [210](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 106
},
"region": {
"startLine": 210,
"snippet": {
"text": "\t\t\t\tsqle.printStackTrace();"
}
},
"contextRegion": {
"startLine": 207,
"endLine": 213,
"snippet": {
"text": "\t\t\tcatch ( SQLException sqle )\n\t\t\t{\n\t\t\t\ts.setMessage( \"Error getting user name\" );\n\t\t\t\tsqle.printStackTrace();\n\t\t\t}\n\t\t}\n\t\tcatch ( Exception e )\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 106
},
"region": {
"startLine": 210,
"snippet": {
"text": "\t\t\t\tsqle.printStackTrace();"
}
},
"contextRegion": {
"startLine": 207,
"endLine": 213,
"snippet": {
"text": "\t\t\tcatch ( SQLException sqle )\n\t\t\t{\n\t\t\t\ts.setMessage( \"Error getting user name\" );\n\t\t\t\tsqle.printStackTrace();\n\t\t\t}\n\t\t}\n\t\tcatch ( Exception e )\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 106
},
"region": {
"startLine": 210
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 25,
"message": {
"text": "Untrusted data is passed to the application and used as a regular expression. This can cause the thread to over-consume CPU resources."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 135
},
"region": {
"startLine": 100,
"snippet": {
"text": "\t\t\tlineSep);"
}
},
"contextRegion": {
"startLine": 97,
"endLine": 103,
"snippet": {
"text": "\t\t//Split by the line separator line.separator is platform independant\n\t\tString lineSep = System.getProperty(\"line.separator\");\n\t\tString[] arrTokens = lang.toString().toUpperCase().split(\n\t\t\tlineSep);\n\n\t\t//Check if the user ended the first request and wrote the second malacious reply\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 544
},
{
"index": 545
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 135
},
"region": {
"startLine": 100,
"snippet": {
"text": "\t\t\tlineSep);"
}
},
"contextRegion": {
"startLine": 97,
"endLine": 103,
"snippet": {
"text": "\t\t//Split by the line separator line.separator is platform independant\n\t\tString lineSep = System.getProperty(\"line.separator\");\n\t\tString[] arrTokens = lang.toString().toUpperCase().split(\n\t\t\tlineSep);\n\n\t\t//Check if the user ended the first request and wrote the second malacious reply\n\n"
}
}
},
"message": {
"text": "split(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 135
},
"region": {
"startLine": 100,
"startColumn": 4
}
}
}
],
"properties": {
"InstanceSeverity": "4.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [ParameterParser.java](1) line [120](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 120,
"endLine": 123,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t return def;\r\n\t}"
}
},
"contextRegion": {
"startLine": 117,
"endLine": 126,
"snippet": {
"text": "\t{\n\t return getBooleanParameter(name);\n\t}\n\tcatch (Exception e)\n\t{\n\t return def;\n\t}\n }\n\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 120,
"endLine": 123,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t return def;\r\n\t}"
}
},
"contextRegion": {
"startLine": 117,
"endLine": 126,
"snippet": {
"text": "\t{\n\t return getBooleanParameter(name);\n\t}\n\tcatch (Exception e)\n\t{\n\t return def;\n\t}\n }\n\n\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 109
},
"region": {
"startLine": 120,
"startColumn": 2,
"endLine": 123
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 138,
"level": "error",
"message": {
"text": "Without proper access control, the method getEmployeeProfile() in [ViewProfile.java](1) can execute a SQL statement on line [132](1) that contains an attacker-controlled primary key, thereby allowing the attacker to access unauthorized records.\r\nWithout proper access control, executing a SQL statement that contains a user-controlled primary key can allow an attacker to view unauthorized records."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 66
},
"region": {
"startLine": 132,
"snippet": {
"text": "\t\tResultSet answer_results = answer_statement.executeQuery(query);"
}
},
"contextRegion": {
"startLine": 129,
"endLine": 135,
"snippet": {
"text": "\t\tStatement answer_statement = WebSession.getConnection(s)\n\t\t\t.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n\t\t\t\tResultSet.CONCUR_READ_ONLY);\n\t\tResultSet answer_results = answer_statement.executeQuery(query);\n\t\tif (answer_results.next())\n\t\t{\n\t\t // Note: Do NOT get the password field.\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 67
},
{
"index": 68
},
{
"index": 69
},
{
"index": 70
},
{
"index": 76
},
{
"index": 77
},
{
"index": 78
},
{
"index": 79
},
{
"index": 80
},
{
"index": 546
},
{
"index": 82
},
{
"index": 547
},
{
"index": 548
},
{
"index": 549
},
{
"index": 550
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 66
},
"region": {
"startLine": 132,
"snippet": {
"text": "\t\tResultSet answer_results = answer_statement.executeQuery(query);"
}
},
"contextRegion": {
"startLine": 129,
"endLine": 135,
"snippet": {
"text": "\t\tStatement answer_statement = WebSession.getConnection(s)\n\t\t\t.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n\t\t\t\tResultSet.CONCUR_READ_ONLY);\n\t\tResultSet answer_results = answer_statement.executeQuery(query);\n\t\tif (answer_results.next())\n\t\t{\n\t\t // Note: Do NOT get the password field.\n"
}
}
},
"message": {
"text": "executeQuery(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 66
},
"region": {
"startLine": 132,
"startColumn": 60
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 42,
"message": {
"text": "The method updateSession() in [HammerHead.java](1) commingles trusted and untrusted data in the same data structure, which encourages programmers to mistakenly trust unvalidated data.\r\nCommingling trusted and untrusted data in the same data structure encourages programmers to mistakenly trust unvalidated data."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 495,
"snippet": {
"text": "\t hs.setAttribute(WebSession.SESSION, session);"
}
},
"contextRegion": {
"startLine": 492,
"endLine": 498,
"snippet": {
"text": "\t // Create new custom session and save it in the HTTP session\n\t // System.out.println( \"HH Creating new WebSession: \" );\n\t session = new WebSession(this, context);\n\t hs.setAttribute(WebSession.SESSION, session);\n\t // reset timeout\n\t hs.setMaxInactiveInterval(sessionTimeoutSeconds);\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 551
},
{
"index": 552
},
{
"index": 553
},
{
"index": 135
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 495,
"snippet": {
"text": "\t hs.setAttribute(WebSession.SESSION, session);"
}
},
"contextRegion": {
"startLine": 492,
"endLine": 498,
"snippet": {
"text": "\t // Create new custom session and save it in the HTTP session\n\t // System.out.println( \"HH Creating new WebSession: \" );\n\t session = new WebSession(this, context);\n\t hs.setAttribute(WebSession.SESSION, session);\n\t // reset timeout\n\t hs.setMaxInactiveInterval(sessionTimeoutSeconds);\n\n"
}
}
},
"message": {
"text": "setAttribute(1)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 495,
"startColumn": 42
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 142,
"message": {
"text": "The call to equals() on line [110](1) causes portability problems because it has different locales which may lead to unexpected output. This may also circumvent custom validation routines.\r\nUnexpected portability problems can be found when the locale is not specified."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 110,
"snippet": {
"text": "\t\t\t\t\t.trim().toLowerCase().equals("
}
},
"contextRegion": {
"startLine": 107,
"endLine": 113,
"snippet": {
"text": "\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls -l #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\n\t\t\t\t\t\t\"ifconfig #\") || helpFile\n\t\t\t\t.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase().equals(\"ipconfig #\")))\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 77,
"snippet": {
"text": "\t if (s.isDefuseOSCommands()"
}
},
"contextRegion": {
"startLine": 74,
"endLine": 80,
"snippet": {
"text": "\t String helpFile = s.getParser().getRawParameter(HELP_FILE,\n\t\t \"BasicAuthentication.help\");\n\t String safeDirName;\n\t if (s.isDefuseOSCommands()\n\t\t && (helpFile.indexOf('&') != -1 || helpFile.indexOf(';') != -1))\n\t {\n\t\tint index = helpFile.indexOf('&');\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 78,
"snippet": {
"text": "\t\t && (helpFile.indexOf('&') != -1 || helpFile.indexOf(';') != -1))"
}
},
"contextRegion": {
"startLine": 75,
"endLine": 81,
"snippet": {
"text": "\t\t \"BasicAuthentication.help\");\n\t String safeDirName;\n\t if (s.isDefuseOSCommands()\n\t\t && (helpFile.indexOf('&') != -1 || helpFile.indexOf(';') != -1))\n\t {\n\t\tint index = helpFile.indexOf('&');\n\t\tif (index == -1)\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 90,
"snippet": {
"text": "\t\tif ((osName.indexOf(\"Windows\") != -1 && (helpFile.substring("
}
},
"contextRegion": {
"startLine": 87,
"endLine": 93,
"snippet": {
"text": "\t\tSystem.out.println(\"Command = [\"\n\t\t\t+ helpFile.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase() + \"]\");\n\t\tif ((osName.indexOf(\"Windows\") != -1 && (helpFile.substring(\n\t\t\tindex, helpFileLen).trim().toLowerCase().equals(\n\t\t\t\"netstat -a\")\n\t\t\t|| helpFile.substring(index, helpFileLen).trim()\n"
}
}
},
"message": {
"text": "Branch not taken"
}
},
"kinds": [
"branch",
"false"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 102,
"snippet": {
"text": "\t\t\t\t.toLowerCase().equals(\"netstat -a #\")"
}
},
"contextRegion": {
"startLine": 99,
"endLine": 105,
"snippet": {
"text": "\t\t\t.substring(index, helpFileLen).trim().toLowerCase()\n\t\t\t.equals(\"ipconfig\")))\n\t\t\t|| (helpFile.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase().equals(\"netstat -a #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n"
}
}
},
"message": {
"text": "Branch not taken"
}
},
"kinds": [
"branch",
"false"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 104,
"snippet": {
"text": "\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")"
}
},
"contextRegion": {
"startLine": 101,
"endLine": 107,
"snippet": {
"text": "\t\t\t|| (helpFile.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase().equals(\"netstat -a #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n"
}
}
},
"message": {
"text": "Branch not taken"
}
},
"kinds": [
"branch",
"false"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 106,
"snippet": {
"text": "\t\t\t\t\t.trim().toLowerCase().equals(\"ls #\")"
}
},
"contextRegion": {
"startLine": 103,
"endLine": 109,
"snippet": {
"text": "\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls -l #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n"
}
}
},
"message": {
"text": "Branch not taken"
}
},
"kinds": [
"branch",
"false"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 108,
"snippet": {
"text": "\t\t\t\t\t.trim().toLowerCase().equals(\"ls -l #\")"
}
},
"contextRegion": {
"startLine": 105,
"endLine": 111,
"snippet": {
"text": "\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls -l #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\n\t\t\t\t\t\t\"ifconfig #\") || helpFile\n"
}
}
},
"message": {
"text": "Branch not taken"
}
},
"kinds": [
"branch",
"false"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 110,
"snippet": {
"text": "\t\t\t\t\t.trim().toLowerCase().equals("
}
},
"contextRegion": {
"startLine": 107,
"endLine": 113,
"snippet": {
"text": "\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls -l #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\n\t\t\t\t\t\t\"ifconfig #\") || helpFile\n\t\t\t\t.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase().equals(\"ipconfig #\")))\n"
}
}
},
"message": {
"text": "toLowerCase() : Case changed using default locale"
}
},
"kinds": [
"acquire",
"resource"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 110,
"snippet": {
"text": "\t\t\t\t\t.trim().toLowerCase().equals("
}
},
"contextRegion": {
"startLine": 107,
"endLine": 113,
"snippet": {
"text": "\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls -l #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\n\t\t\t\t\t\t\"ifconfig #\") || helpFile\n\t\t\t\t.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase().equals(\"ipconfig #\")))\n"
}
}
},
"message": {
"text": "helpFile.substring(index, helpFileLen).trim().toLowerCase().equals(...) : Comparison without checking locale"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 110
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function createProductTable() in [CreateDB.java](1) might reveal system data or debugging information by calling printStackTrace() on line [203](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 40
},
"region": {
"startLine": 203,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 200,
"endLine": 206,
"snippet": {
"text": "\tcatch (SQLException e)\n\t{\n\t System.out.println(\"Error creating product database\");\n\t e.printStackTrace();\n\t}\n\n\t// Populate\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 40
},
"region": {
"startLine": 203,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 200,
"endLine": 206,
"snippet": {
"text": "\tcatch (SQLException e)\n\t{\n\t System.out.println(\"Error creating product database\");\n\t e.printStackTrace();\n\t}\n\n\t// Populate\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 40
},
"region": {
"startLine": 203
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function doHTTPSplitting() in [HttpSplitting.java](1) might reveal system data or debugging information by calling printStackTrace() on line [137](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 135
},
"region": {
"startLine": 137,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 134,
"endLine": 140,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\treturn (ec);\n }\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 135
},
"region": {
"startLine": 137,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 134,
"endLine": 140,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\treturn (ec);\n }\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 135
},
"region": {
"startLine": 137
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 103,
"message": {
"text": "The method execOptions() in [Exec.java](1) calls Thread() on line [303](1). Thread management in a web application is forbidden in some circumstances and is always highly error prone.\r\nThread management in a web application is forbidden in some circumstances and is always highly error prone."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 74
},
"region": {
"startLine": 303,
"snippet": {
"text": "\t\tnew Thread(watcher).start();"
}
},
"contextRegion": {
"startLine": 300,
"endLine": 306,
"snippet": {
"text": "\t if (timeout > 0)\n\t {\n\t\twatcher = new ThreadWatcher(child, interrupted, timeout);\n\t\tnew Thread(watcher).start();\n\t }\n\n\t // Write to the child process' input stream\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 74
},
"region": {
"startLine": 303,
"snippet": {
"text": "\t\tnew Thread(watcher).start();"
}
},
"contextRegion": {
"startLine": 300,
"endLine": 306,
"snippet": {
"text": "\t if (timeout > 0)\n\t {\n\t\twatcher = new ThreadWatcher(child, interrupted, timeout);\n\t\tnew Thread(watcher).start();\n\t }\n\n\t // Write to the child process' input stream\n"
}
}
},
"message": {
"text": "Thread()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 74
},
"region": {
"startLine": 303
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 103,
"message": {
"text": "The method execOptions() in [Exec.java](1) calls Thread() on line [114](1). Thread management in a web application is forbidden in some circumstances and is always highly error prone.\r\nThread management in a web application is forbidden in some circumstances and is always highly error prone."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 74
},
"region": {
"startLine": 114,
"snippet": {
"text": "\t\tnew Thread(watcher).start();"
}
},
"contextRegion": {
"startLine": 111,
"endLine": 117,
"snippet": {
"text": "\t if (timeout > 0)\n\t {\n\t\twatcher = new ThreadWatcher(child, interrupted, timeout);\n\t\tnew Thread(watcher).start();\n\t }\n\n\t // Write to the child process' input stream\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 74
},
"region": {
"startLine": 114,
"snippet": {
"text": "\t\tnew Thread(watcher).start();"
}
},
"contextRegion": {
"startLine": 111,
"endLine": 117,
"snippet": {
"text": "\t if (timeout > 0)\n\t {\n\t\twatcher = new ThreadWatcher(child, interrupted, timeout);\n\t\tnew Thread(watcher).start();\n\t }\n\n\t // Write to the child process' input stream\n"
}
}
},
"message": {
"text": "Thread()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 74
},
"region": {
"startLine": 114
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 127,
"message": {
"text": "The method run() in [ThreadWatcher.java](1) calls sleep() on line [108](1). Thread management in a web application is forbidden in some circumstances and is always highly error prone.\r\nThread management in a web application is forbidden in some circumstances and is always highly error prone."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 41
},
"region": {
"startLine": 108,
"snippet": {
"text": "\t Thread.sleep(myTimeout);"
}
},
"contextRegion": {
"startLine": 105,
"endLine": 111,
"snippet": {
"text": " {\n\ttry\n\t{\n\t Thread.sleep(myTimeout);\n\t}\n\tcatch (InterruptedException e)\n\t{\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 41
},
"region": {
"startLine": 108,
"snippet": {
"text": "\t Thread.sleep(myTimeout);"
}
},
"contextRegion": {
"startLine": 105,
"endLine": 111,
"snippet": {
"text": " {\n\ttry\n\t{\n\t Thread.sleep(myTimeout);\n\t}\n\tcatch (InterruptedException e)\n\t{\n"
}
}
},
"message": {
"text": "sleep()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 41
},
"region": {
"startLine": 108
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 746,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Working with: \" + userInput );"
}
},
"contextRegion": {
"startLine": 743,
"endLine": 749,
"snippet": {
"text": "\t\t{\n\t\t\tString userInput = args[0];\n\t\t\tString userKey = args[1];\n\t\t\tSystem.out.println( \"Working with: \" + userInput );\n\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 746,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Working with: \" + userInput );"
}
},
"contextRegion": {
"startLine": 743,
"endLine": 749,
"snippet": {
"text": "\t\t{\n\t\t\tString userInput = args[0];\n\t\t\tString userKey = args[1];\n\t\t\tSystem.out.println( \"Working with: \" + userInput );\n\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 746
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 747,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Base64 encoding: \" );"
}
},
"contextRegion": {
"startLine": 744,
"endLine": 750,
"snippet": {
"text": "\t\t\tString userInput = args[0];\n\t\t\tString userKey = args[1];\n\t\t\tSystem.out.println( \"Working with: \" + userInput );\n\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 747,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Base64 encoding: \" );"
}
},
"contextRegion": {
"startLine": 744,
"endLine": 750,
"snippet": {
"text": "\t\t\tString userInput = args[0];\n\t\t\tString userKey = args[1];\n\t\t\tSystem.out.println( \"Working with: \" + userInput );\n\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 747
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 748,
"snippet": {
"text": "\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );"
}
},
"contextRegion": {
"startLine": 745,
"endLine": 751,
"snippet": {
"text": "\t\t\tString userKey = args[1];\n\t\t\tSystem.out.println( \"Working with: \" + userInput );\n\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 748,
"snippet": {
"text": "\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );"
}
},
"contextRegion": {
"startLine": 745,
"endLine": 751,
"snippet": {
"text": "\t\t\tString userKey = args[1];\n\t\t\tSystem.out.println( \"Working with: \" + userInput );\n\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 748
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 749,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Entity encoding: \" );"
}
},
"contextRegion": {
"startLine": 746,
"endLine": 752,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Working with: \" + userInput );\n\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 749,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Entity encoding: \" );"
}
},
"contextRegion": {
"startLine": 746,
"endLine": 752,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Working with: \" + userInput );\n\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 749
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 750,
"snippet": {
"text": "\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );"
}
},
"contextRegion": {
"startLine": 747,
"endLine": 753,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 750,
"snippet": {
"text": "\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );"
}
},
"contextRegion": {
"startLine": 747,
"endLine": 753,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Base64 encoding: \" );\n\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 750
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 751,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );"
}
},
"contextRegion": {
"startLine": 748,
"endLine": 754,
"snippet": {
"text": "\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 751,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );"
}
},
"contextRegion": {
"startLine": 748,
"endLine": 754,
"snippet": {
"text": "\t\t\tSystem.out.println( base64Encode( userInput ) + \" : \" + base64Decode( userInput ) );\n\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 751
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 752,
"snippet": {
"text": "\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );"
}
},
"contextRegion": {
"startLine": 749,
"endLine": 755,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 752,
"snippet": {
"text": "\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );"
}
},
"contextRegion": {
"startLine": 749,
"endLine": 755,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Entity encoding: \" );\n\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 752
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 753,
"snippet": {
"text": "\t\t\tSystem.out.print( \"MD5 hash: \" );"
}
},
"contextRegion": {
"startLine": 750,
"endLine": 756,
"snippet": {
"text": "\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 753,
"snippet": {
"text": "\t\t\tSystem.out.print( \"MD5 hash: \" );"
}
},
"contextRegion": {
"startLine": 750,
"endLine": 756,
"snippet": {
"text": "\t\t\tSystem.out.println( HtmlEncoder.encode( userInput ) + \" : \" + HtmlEncoder.decode( userInput ) );\n\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 753
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 754,
"snippet": {
"text": "\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );"
}
},
"contextRegion": {
"startLine": 751,
"endLine": 757,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 754,
"snippet": {
"text": "\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );"
}
},
"contextRegion": {
"startLine": 751,
"endLine": 757,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Password based encryption (PBE): \" );\n\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 754
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 755,
"snippet": {
"text": "\t\t\tSystem.out.print( \"SHA-256 hash: \" );"
}
},
"contextRegion": {
"startLine": 752,
"endLine": 758,
"snippet": {
"text": "\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 755,
"snippet": {
"text": "\t\t\tSystem.out.print( \"SHA-256 hash: \" );"
}
},
"contextRegion": {
"startLine": 752,
"endLine": 758,
"snippet": {
"text": "\t\t\tSystem.out.println( encryptString( userInput, userKey ) + \" : \" + decryptString( userInput, userKey ) );\n\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 755
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 756,
"snippet": {
"text": "\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );"
}
},
"contextRegion": {
"startLine": 753,
"endLine": 759,
"snippet": {
"text": "\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 756,
"snippet": {
"text": "\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );"
}
},
"contextRegion": {
"startLine": 753,
"endLine": 759,
"snippet": {
"text": "\t\t\tSystem.out.print( \"MD5 hash: \" );\n\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 756
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 757,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Unicode encoding: \" );"
}
},
"contextRegion": {
"startLine": 754,
"endLine": 760,
"snippet": {
"text": "\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 757,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Unicode encoding: \" );"
}
},
"contextRegion": {
"startLine": 754,
"endLine": 760,
"snippet": {
"text": "\t\t\tSystem.out.println( hashMD5( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 757
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 758,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );"
}
},
"contextRegion": {
"startLine": 755,
"endLine": 761,
"snippet": {
"text": "\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 758,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );"
}
},
"contextRegion": {
"startLine": 755,
"endLine": 761,
"snippet": {
"text": "\t\t\tSystem.out.print( \"SHA-256 hash: \" );\n\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 758
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 759,
"snippet": {
"text": "\t\t\tSystem.out.print( \"URL encoding: \" );"
}
},
"contextRegion": {
"startLine": 756,
"endLine": 762,
"snippet": {
"text": "\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 759,
"snippet": {
"text": "\t\t\tSystem.out.print( \"URL encoding: \" );"
}
},
"contextRegion": {
"startLine": 756,
"endLine": 762,
"snippet": {
"text": "\t\t\tSystem.out.println( hashSHA( userInput ) + \" : \" + \"Cannot reverse a hash\" );\n\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 759
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 36,
"level": "error",
"message": {
"text": "The method _jspService() in [ListStaff.jsp](1) sends unvalidated data to a web browser on line [8](1), which can result in the browser executing malicious code.\r\nSending unvalidated data to a web browser can result in the browser executing malicious code."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 119
},
"region": {
"startLine": 8,
"snippet": {
"text": "\t Welcome Back <%=webSession.getUserNameInLesson()%> - Staff Listing Page "
}
},
"contextRegion": {
"startLine": 5,
"endLine": 11,
"snippet": {
"text": "\tWebSession webSession = ((WebSession)session.getAttribute(\"websession\"));\n\tint myUserId = webSession.getUserIdInLesson();\n%>\n\tWelcome Back <%=webSession.getUserNameInLesson()%> - Staff Listing Page \n\t\t
\n\t\t
\n\t\t
\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 507
},
{
"index": 508
},
{
"index": 509
},
{
"index": 510
},
{
"index": 511
},
{
"index": 512
},
{
"index": 516
},
{
"index": 517
},
{
"index": 518
},
{
"index": 528
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 119
},
"region": {
"startLine": 8,
"snippet": {
"text": "\tWelcome Back <%=webSession.getUserNameInLesson()%> - Staff Listing Page "
}
},
"contextRegion": {
"startLine": 5,
"endLine": 11,
"snippet": {
"text": "\tWebSession webSession = ((WebSession)session.getAttribute(\"websession\"));\n\tint myUserId = webSession.getUserIdInLesson();\n%>\n\tWelcome Back <%=webSession.getUserNameInLesson()%> - Staff Listing Page \n\t\t
\n\t\t
\n\t\t
\n"
}
}
},
"message": {
"text": "print(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
},
{
"threadFlows": [
{
"locations": [
{
"index": 507
},
{
"index": 508
},
{
"index": 509
},
{
"index": 510
},
{
"index": 511
},
{
"index": 520
},
{
"index": 521
},
{
"index": 517
},
{
"index": 518
},
{
"index": 528
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 119
},
"region": {
"startLine": 8,
"snippet": {
"text": "\tWelcome Back <%=webSession.getUserNameInLesson()%> - Staff Listing Page "
}
},
"contextRegion": {
"startLine": 5,
"endLine": 11,
"snippet": {
"text": "\tWebSession webSession = ((WebSession)session.getAttribute(\"websession\"));\n\tint myUserId = webSession.getUserIdInLesson();\n%>\n\tWelcome Back <%=webSession.getUserNameInLesson()%> - Staff Listing Page \n\t\t
\n\t\t
\n\t\t
\n"
}
}
},
"message": {
"text": "print(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
},
{
"threadFlows": [
{
"locations": [
{
"index": 507
},
{
"index": 508
},
{
"index": 509
},
{
"index": 510
},
{
"index": 511
},
{
"index": 523
},
{
"index": 524
},
{
"index": 517
},
{
"index": 518
},
{
"index": 528
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 119
},
"region": {
"startLine": 8,
"snippet": {
"text": "\tWelcome Back <%=webSession.getUserNameInLesson()%> - Staff Listing Page "
}
},
"contextRegion": {
"startLine": 5,
"endLine": 11,
"snippet": {
"text": "\tWebSession webSession = ((WebSession)session.getAttribute(\"websession\"));\n\tint myUserId = webSession.getUserIdInLesson();\n%>\n\tWelcome Back <%=webSession.getUserNameInLesson()%> - Staff Listing Page \n\t\t
\n\t\t
\n\t\t
\n"
}
}
},
"message": {
"text": "print(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 119
},
"region": {
"startLine": 8
}
}
}
],
"properties": {
"InstanceSeverity": "4.0",
"Confidence": "3.2166665"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 761,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Hex encoding: \" );"
}
},
"contextRegion": {
"startLine": 758,
"endLine": 764,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 761,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Hex encoding: \" );"
}
},
"contextRegion": {
"startLine": 758,
"endLine": 764,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 761
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 762,
"snippet": {
"text": "\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );"
}
},
"contextRegion": {
"startLine": 759,
"endLine": 765,
"snippet": {
"text": "\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 762,
"snippet": {
"text": "\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );"
}
},
"contextRegion": {
"startLine": 759,
"endLine": 765,
"snippet": {
"text": "\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 762
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 763,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Rot13 encoding: \" );"
}
},
"contextRegion": {
"startLine": 760,
"endLine": 766,
"snippet": {
"text": "\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 763,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Rot13 encoding: \" );"
}
},
"contextRegion": {
"startLine": 760,
"endLine": 766,
"snippet": {
"text": "\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 763
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 764,
"snippet": {
"text": "\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );"
}
},
"contextRegion": {
"startLine": 761,
"endLine": 767,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 764,
"snippet": {
"text": "\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );"
}
},
"contextRegion": {
"startLine": 761,
"endLine": 767,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 764
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 765,
"snippet": {
"text": "\t\t\tSystem.out.print( \"XOR with password: \" );"
}
},
"contextRegion": {
"startLine": 762,
"endLine": 768,
"snippet": {
"text": "\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 765,
"snippet": {
"text": "\t\t\tSystem.out.print( \"XOR with password: \" );"
}
},
"contextRegion": {
"startLine": 762,
"endLine": 768,
"snippet": {
"text": "\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 765
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 766,
"snippet": {
"text": "\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );"
}
},
"contextRegion": {
"startLine": 763,
"endLine": 769,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 766,
"snippet": {
"text": "\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );"
}
},
"contextRegion": {
"startLine": 763,
"endLine": 769,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 766
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 767,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Double unicode encoding is...\" );"
}
},
"contextRegion": {
"startLine": 764,
"endLine": 770,
"snippet": {
"text": "\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 767,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Double unicode encoding is...\" );"
}
},
"contextRegion": {
"startLine": 764,
"endLine": 770,
"snippet": {
"text": "\t\t\tSystem.out.println( rot13( userInput ) + \" : \" + rot13( userInput ) );\n\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 767
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 768,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );"
}
},
"contextRegion": {
"startLine": 765,
"endLine": 771,
"snippet": {
"text": "\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );\n\t\t}\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 768,
"snippet": {
"text": "\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );"
}
},
"contextRegion": {
"startLine": 765,
"endLine": 771,
"snippet": {
"text": "\t\t\tSystem.out.print( \"XOR with password: \" );\n\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );\n\t\t}\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 768
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using print() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 769,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Double URL encoding: \" );"
}
},
"contextRegion": {
"startLine": 766,
"endLine": 772,
"snippet": {
"text": "\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );\n\t\t}\n\t\tcatch ( Exception e )\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 769,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Double URL encoding: \" );"
}
},
"contextRegion": {
"startLine": 766,
"endLine": 772,
"snippet": {
"text": "\t\t\tSystem.out.println( xorEncode( userInput, userKey ) + \" : \" + xorDecode( userInput, userKey ) );\n\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );\n\t\t}\n\t\tcatch ( Exception e )\n"
}
}
},
"message": {
"text": "FunctionCall: print"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 769
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 770,
"snippet": {
"text": "\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );"
}
},
"contextRegion": {
"startLine": 767,
"endLine": 773,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );\n\t\t}\n\t\tcatch ( Exception e )\n\t\t{\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 770,
"snippet": {
"text": "\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );"
}
},
"contextRegion": {
"startLine": 767,
"endLine": 773,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Double unicode encoding is...\" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"Double URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( urlEncode( userInput ) ) + \" : \" + urlDecode( urlDecode( userInput ) ) );\n\t\t}\n\t\tcatch ( Exception e )\n\t\t{\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 770
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 36,
"level": "error",
"message": {
"text": "The method _jspService() in [ViewProfile.jsp](1) sends unvalidated data to a web browser on line [11](1), which can result in the browser executing malicious code.\r\nSending unvalidated data to a web browser can result in the browser executing malicious code."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 16
},
"region": {
"startLine": 11,
"snippet": {
"text": "\t\tWelcome Back <%=webSession.getUserNameInLesson()%> "
}
},
"contextRegion": {
"startLine": 8,
"endLine": 14,
"snippet": {
"text": "\tEmployee employee = (Employee) session.getAttribute(\"CrossSiteScripting.\" + CrossSiteScripting.EMPLOYEE_ATTRIBUTE_KEY);\n//\tint myUserId = getIntSessionAttribute(webSession, \"CrossSiteScripting.\" + CrossSiteScripting.USER_ID);\n%>\n\t\tWelcome Back <%=webSession.getUserNameInLesson()%> \n\t\t\n\t\t\t\t \n\t\t\t\t| \n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 507
},
{
"index": 508
},
{
"index": 509
},
{
"index": 510
},
{
"index": 511
},
{
"index": 512
},
{
"index": 516
},
{
"index": 517
},
{
"index": 518
},
{
"index": 519
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 16
},
"region": {
"startLine": 11,
"snippet": {
"text": "\t\t Welcome Back <%=webSession.getUserNameInLesson()%> "
}
},
"contextRegion": {
"startLine": 8,
"endLine": 14,
"snippet": {
"text": "\tEmployee employee = (Employee) session.getAttribute(\"CrossSiteScripting.\" + CrossSiteScripting.EMPLOYEE_ATTRIBUTE_KEY);\n//\tint myUserId = getIntSessionAttribute(webSession, \"CrossSiteScripting.\" + CrossSiteScripting.USER_ID);\n%>\n\t\tWelcome Back <%=webSession.getUserNameInLesson()%> \n\t\t\n\t\t\t\t \n\t\t\t\t| \n"
}
}
},
"message": {
"text": "print(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
},
{
"threadFlows": [
{
"locations": [
{
"index": 507
},
{
"index": 508
},
{
"index": 509
},
{
"index": 510
},
{
"index": 511
},
{
"index": 520
},
{
"index": 521
},
{
"index": 517
},
{
"index": 518
},
{
"index": 519
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 16
},
"region": {
"startLine": 11,
"snippet": {
"text": "\t\t Welcome Back <%=webSession.getUserNameInLesson()%> "
}
},
"contextRegion": {
"startLine": 8,
"endLine": 14,
"snippet": {
"text": "\tEmployee employee = (Employee) session.getAttribute(\"CrossSiteScripting.\" + CrossSiteScripting.EMPLOYEE_ATTRIBUTE_KEY);\n//\tint myUserId = getIntSessionAttribute(webSession, \"CrossSiteScripting.\" + CrossSiteScripting.USER_ID);\n%>\n\t\tWelcome Back <%=webSession.getUserNameInLesson()%> \n\t\t\n\t\t\t\t \n\t\t\t\t| \n"
}
}
},
"message": {
"text": "print(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
},
{
"threadFlows": [
{
"locations": [
{
"index": 507
},
{
"index": 508
},
{
"index": 509
},
{
"index": 510
},
{
"index": 511
},
{
"index": 523
},
{
"index": 524
},
{
"index": 517
},
{
"index": 518
},
{
"index": 519
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 16
},
"region": {
"startLine": 11,
"snippet": {
"text": "\t\t Welcome Back <%=webSession.getUserNameInLesson()%> "
}
},
"contextRegion": {
"startLine": 8,
"endLine": 14,
"snippet": {
"text": "\tEmployee employee = (Employee) session.getAttribute(\"CrossSiteScripting.\" + CrossSiteScripting.EMPLOYEE_ATTRIBUTE_KEY);\n//\tint myUserId = getIntSessionAttribute(webSession, \"CrossSiteScripting.\" + CrossSiteScripting.USER_ID);\n%>\n\t\tWelcome Back <%=webSession.getUserNameInLesson()%> \n\t\t\n\t\t\t\t \n\t\t\t\t| \n"
}
}
},
"message": {
"text": "print(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 16
},
"region": {
"startLine": 11
}
}
}
],
"properties": {
"InstanceSeverity": "4.0",
"Confidence": "3.2166665"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [ReflectedXSS.java](1) line [219](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 137
},
"region": {
"startLine": 219,
"endLine": 223,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\r\n\t e.printStackTrace();\r\n\t}"
}
},
"contextRegion": {
"startLine": 216,
"endLine": 226,
"snippet": {
"text": "\t ec.addElement(new BR());\n\t ec.addElement(new HR().setWidth(\"90%\"));\n\t}\n\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\treturn (ec);\n }\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 137
},
"region": {
"startLine": 219,
"endLine": 223,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\r\n\t e.printStackTrace();\r\n\t}"
}
},
"contextRegion": {
"startLine": 216,
"endLine": 226,
"snippet": {
"text": "\t ec.addElement(new BR());\n\t ec.addElement(new HR().setWidth(\"90%\"));\n\t}\n\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\treturn (ec);\n }\n\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 137
},
"region": {
"startLine": 219,
"startColumn": 2,
"endLine": 223
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [ThreadSafetyProblem.java](1) line [214](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 12
},
"region": {
"startLine": 214,
"endLine": 218,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t System.out.println(\"Exception caught: \" + e);\r\n\t e.printStackTrace(System.out);\r\n\t}"
}
},
"contextRegion": {
"startLine": 211,
"endLine": 221,
"snippet": {
"text": "\t\tconnection = DatabaseUtilities.makeConnection(s);\n\t }\n\t}\n\tcatch (Exception e)\n\t{\n\t System.out.println(\"Exception caught: \" + e);\n\t e.printStackTrace(System.out);\n\t}\n }\n \n public Element getCredits()\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 12
},
"region": {
"startLine": 214,
"endLine": 218,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t System.out.println(\"Exception caught: \" + e);\r\n\t e.printStackTrace(System.out);\r\n\t}"
}
},
"contextRegion": {
"startLine": 211,
"endLine": 221,
"snippet": {
"text": "\t\tconnection = DatabaseUtilities.makeConnection(s);\n\t }\n\t}\n\tcatch (Exception e)\n\t{\n\t System.out.println(\"Exception caught: \" + e);\n\t e.printStackTrace(System.out);\n\t}\n }\n \n public Element getCredits()\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 12
},
"region": {
"startLine": 214,
"startColumn": 2,
"endLine": 218
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 68,
"message": {
"text": "Without proper access control, the method changeEmployeeProfile() in [UpdateProfile.java](1) can execute a SQL statement on line [248](1) that contains an attacker-controlled primary key, thereby allowing the attacker to access unauthorized records.\r\nWithout proper access control, executing a SQL statement that contains a user-controlled primary key can allow an attacker to view unauthorized records."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 30
},
"region": {
"startLine": 248,
"snippet": {
"text": "\t\tanswer_statement.executeUpdate(query);"
}
},
"contextRegion": {
"startLine": 245,
"endLine": 251,
"snippet": {
"text": "\t\tStatement answer_statement = WebSession.getConnection(s)\n\t\t\t.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n\t\t\t\tResultSet.CONCUR_READ_ONLY);\n\t\tanswer_statement.executeUpdate(query);\n\t }\n\t catch (SQLException sqle)\n\t {\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 234
},
{
"index": 235
},
{
"index": 236
},
{
"index": 237
},
{
"index": 90
},
{
"index": 91
},
{
"index": 239
},
{
"index": 93
},
{
"index": 554
},
{
"index": 555
},
{
"index": 82
},
{
"index": 149
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 30
},
"region": {
"startLine": 248,
"snippet": {
"text": "\t\tanswer_statement.executeUpdate(query);"
}
},
"contextRegion": {
"startLine": 245,
"endLine": 251,
"snippet": {
"text": "\t\tStatement answer_statement = WebSession.getConnection(s)\n\t\t\t.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n\t\t\t\tResultSet.CONCUR_READ_ONLY);\n\t\tanswer_statement.executeUpdate(query);\n\t }\n\t catch (SQLException sqle)\n\t {\n"
}
}
},
"message": {
"text": "executeUpdate(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 30
},
"region": {
"startLine": 248,
"startColumn": 34
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 108,
"level": "error",
"message": {
"text": "The method ParameterNotFoundException() in [ParameterNotFoundException.java](1) mishandles confidential information, which can compromise user privacy and is often illegal.\r\nMishandling private information, such as customer passwords or social security numbers, can compromise user privacy and is often illegal."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 77
},
"region": {
"startLine": 54,
"snippet": {
"text": "\tsuper(s);"
}
},
"contextRegion": {
"startLine": 51,
"endLine": 57,
"snippet": {
"text": " */\n public ParameterNotFoundException(String s)\n {\n\tsuper(s);\n }\n}\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 60
},
{
"index": 61
},
{
"index": 164
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 77
},
"region": {
"startLine": 54,
"snippet": {
"text": "\tsuper(s);"
}
},
"contextRegion": {
"startLine": 51,
"endLine": 57,
"snippet": {
"text": " */\n public ParameterNotFoundException(String s)\n {\n\tsuper(s);\n }\n}\n"
}
}
},
"message": {
"text": "Exception(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 77
},
"region": {
"startLine": 54,
"startColumn": 8
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 16,
"message": {
"text": "Storing passwords or password details in plaintext anywhere in the system or system code may compromise system security in a way that cannot be easily remedied."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 48
},
"region": {
"startLine": 98,
"snippet": {
"text": "\t // Don't let the fail open pass with a blank password."
}
},
"contextRegion": {
"startLine": 95,
"endLine": 101,
"snippet": {
"text": "\t\t}\n\t }\n\n\t // Don't let the fail open pass with a blank password.\n\t if (password.length() == 0)\n\t {\n\t\t// We make sure the username was submitted to avoid telling the user an invalid\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 48
},
"region": {
"startLine": 98,
"snippet": {
"text": "\t // Don't let the fail open pass with a blank password."
}
},
"contextRegion": {
"startLine": 95,
"endLine": 101,
"snippet": {
"text": "\t\t}\n\t }\n\n\t // Don't let the fail open pass with a blank password.\n\t if (password.length() == 0)\n\t {\n\t\t// We make sure the username was submitted to avoid telling the user an invalid\n"
}
}
},
"message": {
"text": "Comment"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 48
},
"region": {
"startLine": 98,
"startColumn": 6
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function getDatabaseConnectionString() in [WebSession.java](1) might reveal system data or debugging information by calling printStackTrace() on line [448](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 46
},
"region": {
"startLine": 448,
"snippet": {
"text": "\t\t\te.printStackTrace();"
}
},
"contextRegion": {
"startLine": 445,
"endLine": 451,
"snippet": {
"text": "\t\tcatch ( Exception e )\n\t\t{\n\t\t\tSystem.out.println( \"Couldn't open database: check web.xml database parameters\" );\n\t\t\te.printStackTrace();\n\t\t}\n\n\t\treturn null;\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 46
},
"region": {
"startLine": 448,
"snippet": {
"text": "\t\t\te.printStackTrace();"
}
},
"contextRegion": {
"startLine": 445,
"endLine": 451,
"snippet": {
"text": "\t\tcatch ( Exception e )\n\t\t{\n\t\t\tSystem.out.println( \"Couldn't open database: check web.xml database parameters\" );\n\t\t\te.printStackTrace();\n\t\t}\n\n\t\treturn null;\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 46
},
"region": {
"startLine": 448
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [Login.java](1) line [166](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 37
},
"region": {
"startLine": 166,
"endLine": 170,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t s.setMessage(\"Error logging in\");\r\n\t e.printStackTrace();\r\n\t}"
}
},
"contextRegion": {
"startLine": 163,
"endLine": 173,
"snippet": {
"text": "\t\tsqle.printStackTrace();\n\t }\n\t}\n\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error logging in\");\n\t e.printStackTrace();\n\t}\n\n\t//System.out.println(\"Lesson login result: \" + authenticated);\n\treturn authenticated;\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 37
},
"region": {
"startLine": 166,
"endLine": 170,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t s.setMessage(\"Error logging in\");\r\n\t e.printStackTrace();\r\n\t}"
}
},
"contextRegion": {
"startLine": 163,
"endLine": 173,
"snippet": {
"text": "\t\tsqle.printStackTrace();\n\t }\n\t}\n\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error logging in\");\n\t e.printStackTrace();\n\t}\n\n\t//System.out.println(\"Lesson login result: \" + authenticated);\n\treturn authenticated;\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 37
},
"region": {
"startLine": 166,
"startColumn": 2,
"endLine": 170
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 33,
"level": "note",
"message": {
"text": "Using println() rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.\r\nUsing `System.out` or `System.err` rather than a dedicated logging facility makes it difficult to monitor the behavior of the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 760,
"snippet": {
"text": "\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );"
}
},
"contextRegion": {
"startLine": 757,
"endLine": 763,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 760,
"snippet": {
"text": "\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );"
}
},
"contextRegion": {
"startLine": 757,
"endLine": 763,
"snippet": {
"text": "\t\t\tSystem.out.print( \"Unicode encoding: \" );\n\t\t\tSystem.out.println( \"Not Implemented\" + \" : \" + \"Not Implemented\" );\n\t\t\tSystem.out.print( \"URL encoding: \" );\n\t\t\tSystem.out.println( urlEncode( userInput ) + \" : \" + urlDecode( userInput ) );\n\t\t\tSystem.out.print( \"Hex encoding: \" );\n\t\t\tSystem.out.println( hexEncode( userInput ) + \" : \" + hexDecode( userInput ) );\n\t\t\tSystem.out.print( \"Rot13 encoding: \" );\n"
}
}
},
"message": {
"text": "FunctionCall: println"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 760
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [LessonTracker.java](1) line [391](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 14
},
"region": {
"startLine": 391,
"endLine": 396,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t // what do we want to do, I think nothing.\r\n\t System.out.println(\"Warning User data for \" + s.getUserName()\r\n\t\t + \" will not persist\");\r\n\t}"
}
},
"contextRegion": {
"startLine": 388,
"endLine": 399,
"snippet": {
"text": "\t out = new FileOutputStream(fileName);\n\t lessonProperties.store(out, s.getUserName());\n\t}\n\tcatch (Exception e)\n\t{\n\t // what do we want to do, I think nothing.\n\t System.out.println(\"Warning User data for \" + s.getUserName()\n\t\t + \" will not persist\");\n\t}\n\tfinally\n\t{\n\t try\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 14
},
"region": {
"startLine": 391,
"endLine": 396,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t // what do we want to do, I think nothing.\r\n\t System.out.println(\"Warning User data for \" + s.getUserName()\r\n\t\t + \" will not persist\");\r\n\t}"
}
},
"contextRegion": {
"startLine": 388,
"endLine": 399,
"snippet": {
"text": "\t out = new FileOutputStream(fileName);\n\t lessonProperties.store(out, s.getUserName());\n\t}\n\tcatch (Exception e)\n\t{\n\t // what do we want to do, I think nothing.\n\t System.out.println(\"Warning User data for \" + s.getUserName()\n\t\t + \" will not persist\");\n\t}\n\tfinally\n\t{\n\t try\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 14
},
"region": {
"startLine": 391,
"startColumn": 2,
"endLine": 396
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [LessonTracker.java](1) line [403](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 14
},
"region": {
"startLine": 403,
"endLine": 404,
"snippet": {
"text": "\t catch (Exception e)\r\n\t {}"
}
},
"contextRegion": {
"startLine": 400,
"endLine": 407,
"snippet": {
"text": "\t {\n\t\tout.close();\n\t }\n\t catch (Exception e)\n\t {}\n\t}\n\n }\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 14
},
"region": {
"startLine": 403,
"endLine": 404,
"snippet": {
"text": "\t catch (Exception e)\r\n\t {}"
}
},
"contextRegion": {
"startLine": 400,
"endLine": 407,
"snippet": {
"text": "\t {\n\t\tout.close();\n\t }\n\t catch (Exception e)\n\t {}\n\t}\n\n }\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 14
},
"region": {
"startLine": 403,
"startColumn": 6,
"endLine": 404
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function createContent() in [UncheckedEmail.java](1) might reveal system data or debugging information by calling printStackTrace() on line [196](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 91
},
"region": {
"startLine": 196,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 193,
"endLine": 199,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\treturn (ec);\n }\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 91
},
"region": {
"startLine": 196,
"snippet": {
"text": "\t e.printStackTrace();"
}
},
"contextRegion": {
"startLine": 193,
"endLine": 199,
"snippet": {
"text": "\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\treturn (ec);\n }\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 91
},
"region": {
"startLine": 196
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 102,
"level": "error",
"message": {
"text": "On line [134](1) of [DOS_Login.java](1), the method createContent() invokes a SQL query built using input coming from an untrusted source. This call could allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.\r\nConstructing a dynamic SQL statement with input coming from an untrusted source could allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 45
},
"region": {
"startLine": 134,
"snippet": {
"text": "\t\t\t statement.executeUpdate(insertData1);"
}
},
"contextRegion": {
"startLine": 131,
"endLine": 137,
"snippet": {
"text": "\t\t\t\t + \"', '\"\n\t\t\t\t + s.getUserName()\n\t\t\t\t + \"' )\";\n\t\t\t statement.executeUpdate(insertData1);\n\t\t\t}\n\t\t\t// check the total count of logins\n\t\t\tquery = \"SELECT * FROM user_login WHERE webgoat_user = '\"\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 0
},
{
"index": 2
},
{
"index": 3
},
{
"index": 556
},
{
"index": 557
},
{
"index": 558
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 45
},
"region": {
"startLine": 134,
"snippet": {
"text": "\t\t\t statement.executeUpdate(insertData1);"
}
},
"contextRegion": {
"startLine": 131,
"endLine": 137,
"snippet": {
"text": "\t\t\t\t + \"', '\"\n\t\t\t\t + s.getUserName()\n\t\t\t\t + \"' )\";\n\t\t\t statement.executeUpdate(insertData1);\n\t\t\t}\n\t\t\t// check the total count of logins\n\t\t\tquery = \"SELECT * FROM user_login WHERE webgoat_user = '\"\n"
}
}
},
"message": {
"text": "executeUpdate(0)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 45
},
"region": {
"startLine": 134,
"startColumn": 32
}
}
}
],
"properties": {
"InstanceSeverity": "4.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 42,
"message": {
"text": "The method doPost() in [HammerHead.java](1) commingles trusted and untrusted data in the same data structure, which encourages programmers to mistakenly trust unvalidated data.\r\nCommingling trusted and untrusted data in the same data structure encourages programmers to mistakenly trust unvalidated data."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 184,
"snippet": {
"text": "\t request.getSession().setAttribute(\"websession\", mySession);"
}
},
"contextRegion": {
"startLine": 181,
"endLine": 187,
"snippet": {
"text": "\t\tclientBrowser = userAgent;\n\t }\n\t request.setAttribute(\"client.browser\", clientBrowser);\n\t request.getSession().setAttribute(\"websession\", mySession);\n\t request.getSession().setAttribute(\"course\", mySession.getCourse());\n\n\t request.getRequestDispatcher(getViewPage(mySession)).forward(\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"index": 551
},
{
"index": 552
},
{
"index": 553
},
{
"index": 135
},
{
"index": 157
},
{
"index": 559
},
{
"index": 159
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 184,
"snippet": {
"text": "\t request.getSession().setAttribute(\"websession\", mySession);"
}
},
"contextRegion": {
"startLine": 181,
"endLine": 187,
"snippet": {
"text": "\t\tclientBrowser = userAgent;\n\t }\n\t request.setAttribute(\"client.browser\", clientBrowser);\n\t request.getSession().setAttribute(\"websession\", mySession);\n\t request.getSession().setAttribute(\"course\", mySession.getCourse());\n\n\t request.getRequestDispatcher(getViewPage(mySession)).forward(\n"
}
}
},
"message": {
"text": "setAttribute(1)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
},
{
"threadFlows": [
{
"locations": [
{
"index": 551
},
{
"index": 552
},
{
"index": 553
},
{
"index": 135
},
{
"index": 179
},
{
"index": 180
},
{
"index": 181
},
{
"index": 182
},
{
"index": 183
},
{
"index": 157
},
{
"index": 559
},
{
"index": 159
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 184,
"snippet": {
"text": "\t request.getSession().setAttribute(\"websession\", mySession);"
}
},
"contextRegion": {
"startLine": 181,
"endLine": 187,
"snippet": {
"text": "\t\tclientBrowser = userAgent;\n\t }\n\t request.setAttribute(\"client.browser\", clientBrowser);\n\t request.getSession().setAttribute(\"websession\", mySession);\n\t request.getSession().setAttribute(\"course\", mySession.getCourse());\n\n\t request.getRequestDispatcher(getViewPage(mySession)).forward(\n"
}
}
},
"message": {
"text": "setAttribute(1)"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 71
},
"region": {
"startLine": 184
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 104,
"level": "note",
"message": {
"text": "The method createContent() in [TraceXSS.java](1) never uses the initial value it assigns to the variable quantity on line [77](1).\r\nThe variable's value is assigned but never used, making it a dead store."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 62
},
"region": {
"startLine": 77,
"snippet": {
"text": "\t float quantity = 1.0f;"
}
},
"contextRegion": {
"startLine": 74,
"endLine": 80,
"snippet": {
"text": "\t String param1 = s.getParser().getRawParameter(\"field1\", \"111\");\n\t String param2 = HtmlEncoder.encode(s.getParser().getRawParameter(\n\t\t \"field2\", \"4128 3214 0002 1999\"));\n\t float quantity = 1.0f;\n\t float total = 0.0f;\n\t float runningTotal = 0.0f;\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 62
},
"region": {
"startLine": 77,
"snippet": {
"text": "\t float quantity = 1.0f;"
}
},
"contextRegion": {
"startLine": 74,
"endLine": 80,
"snippet": {
"text": "\t String param1 = s.getParser().getRawParameter(\"field1\", \"111\");\n\t String param2 = HtmlEncoder.encode(s.getParser().getRawParameter(\n\t\t \"field2\", \"4128 3214 0002 1999\"));\n\t float quantity = 1.0f;\n\t float total = 0.0f;\n\t float runningTotal = 0.0f;\n\n"
}
}
},
"message": {
"text": "VariableAccess: quantity"
}
},
"kinds": [
"unknown"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 62
},
"region": {
"startLine": 77,
"snippet": {
"text": "\t float quantity = 1.0f;"
}
},
"contextRegion": {
"startLine": 74,
"endLine": 80,
"snippet": {
"text": "\t String param1 = s.getParser().getRawParameter(\"field1\", \"111\");\n\t String param2 = HtmlEncoder.encode(s.getParser().getRawParameter(\n\t\t \"field2\", \"4128 3214 0002 1999\"));\n\t float quantity = 1.0f;\n\t float total = 0.0f;\n\t float runningTotal = 0.0f;\n\n"
}
}
},
"message": {
"text": "Variable: quantity"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 62
},
"region": {
"startLine": 77,
"startColumn": 6
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 104,
"level": "note",
"message": {
"text": "The method createContent() in [TraceXSS.java](1) never uses the initial value it assigns to the variable total on line [78](1).\r\nThe variable's value is assigned but never used, making it a dead store."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 62
},
"region": {
"startLine": 78,
"snippet": {
"text": "\t float total = 0.0f;"
}
},
"contextRegion": {
"startLine": 75,
"endLine": 81,
"snippet": {
"text": "\t String param2 = HtmlEncoder.encode(s.getParser().getRawParameter(\n\t\t \"field2\", \"4128 3214 0002 1999\"));\n\t float quantity = 1.0f;\n\t float total = 0.0f;\n\t float runningTotal = 0.0f;\n\n\t // test input field1\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 62
},
"region": {
"startLine": 78,
"snippet": {
"text": "\t float total = 0.0f;"
}
},
"contextRegion": {
"startLine": 75,
"endLine": 81,
"snippet": {
"text": "\t String param2 = HtmlEncoder.encode(s.getParser().getRawParameter(\n\t\t \"field2\", \"4128 3214 0002 1999\"));\n\t float quantity = 1.0f;\n\t float total = 0.0f;\n\t float runningTotal = 0.0f;\n\n\t // test input field1\n"
}
}
},
"message": {
"text": "VariableAccess: total"
}
},
"kinds": [
"unknown"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 62
},
"region": {
"startLine": 78,
"snippet": {
"text": "\t float total = 0.0f;"
}
},
"contextRegion": {
"startLine": 75,
"endLine": 81,
"snippet": {
"text": "\t String param2 = HtmlEncoder.encode(s.getParser().getRawParameter(\n\t\t \"field2\", \"4128 3214 0002 1999\"));\n\t float quantity = 1.0f;\n\t float total = 0.0f;\n\t float runningTotal = 0.0f;\n\n\t // test input field1\n"
}
}
},
"message": {
"text": "Variable: total"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 62
},
"region": {
"startLine": 78,
"startColumn": 6
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 70,
"message": {
"text": "The call to String() on line [266](1) of [Encoding.java](1) converts a byte array into a `String`, which may lead to data loss.\r\nConverting a byte array into a `String` may lead to data loss."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 266,
"snippet": {
"text": "\t\treturn ( new String( b ) );"
}
},
"contextRegion": {
"startLine": 263,
"endLine": 269,
"snippet": {
"text": "\n\t\tbyte[] b = decoder.decodeBuffer( str );\n\n\t\treturn ( new String( b ) );\n\t}\n\n\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 266,
"snippet": {
"text": "\t\treturn ( new String( b ) );"
}
},
"contextRegion": {
"startLine": 263,
"endLine": 269,
"snippet": {
"text": "\n\t\tbyte[] b = decoder.decodeBuffer( str );\n\n\t\treturn ( new String( b ) );\n\t}\n\n\n"
}
}
},
"message": {
"text": "String()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 50
},
"region": {
"startLine": 266
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 72,
"message": {
"text": "The function doFilter() in [Interceptor.java](1) sometimes fails to release a socket allocated by Socket() on line 93.\r\nThe program can potentially fail to release a socket."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 97,
"snippet": {
"text": "\t\t out = new PrintWriter(osgSocket.getOutputStream(), true);"
}
},
"contextRegion": {
"startLine": 94,
"endLine": 100,
"snippet": {
"text": "\t\t\t.parseInt(osgServerPort));\n\t\tif (osgSocket != null)\n\t\t{\n\t\t out = new PrintWriter(osgSocket.getOutputStream(), true);\n\t\t in = new BufferedReader(new InputStreamReader(osgSocket\n\t\t\t .getInputStream()));\n\t\t //String message = \"HTTPRECEIVEHTTPREQUEST,-,DataValidation_SqlInjection_Basic.aspx\";\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 90,
"snippet": {
"text": "\t if (osgServerName != null && osgServerName.length() != 0"
}
},
"contextRegion": {
"startLine": 87,
"endLine": 93,
"snippet": {
"text": "\ttry\n\t{\n\t //If these parameters are not defined then no communication will happen with OSG\n\t if (osgServerName != null && osgServerName.length() != 0\n\t\t && osgServerPort != null && osgServerPort.length() != 0)\n\t {\n\t\tosgSocket = new Socket(osgServerName, Integer\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 90,
"snippet": {
"text": "\t if (osgServerName != null && osgServerName.length() != 0"
}
},
"contextRegion": {
"startLine": 87,
"endLine": 93,
"snippet": {
"text": "\ttry\n\t{\n\t //If these parameters are not defined then no communication will happen with OSG\n\t if (osgServerName != null && osgServerName.length() != 0\n\t\t && osgServerPort != null && osgServerPort.length() != 0)\n\t {\n\t\tosgSocket = new Socket(osgServerName, Integer\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 91,
"snippet": {
"text": "\t\t && osgServerPort != null && osgServerPort.length() != 0)"
}
},
"contextRegion": {
"startLine": 88,
"endLine": 94,
"snippet": {
"text": "\t{\n\t //If these parameters are not defined then no communication will happen with OSG\n\t if (osgServerName != null && osgServerName.length() != 0\n\t\t && osgServerPort != null && osgServerPort.length() != 0)\n\t {\n\t\tosgSocket = new Socket(osgServerName, Integer\n\t\t\t.parseInt(osgServerPort));\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 91,
"snippet": {
"text": "\t\t && osgServerPort != null && osgServerPort.length() != 0)"
}
},
"contextRegion": {
"startLine": 88,
"endLine": 94,
"snippet": {
"text": "\t{\n\t //If these parameters are not defined then no communication will happen with OSG\n\t if (osgServerName != null && osgServerName.length() != 0\n\t\t && osgServerPort != null && osgServerPort.length() != 0)\n\t {\n\t\tosgSocket = new Socket(osgServerName, Integer\n\t\t\t.parseInt(osgServerPort));\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 93,
"snippet": {
"text": "\t\tosgSocket = new Socket(osgServerName, Integer"
}
},
"contextRegion": {
"startLine": 90,
"endLine": 96,
"snippet": {
"text": "\t if (osgServerName != null && osgServerName.length() != 0\n\t\t && osgServerPort != null && osgServerPort.length() != 0)\n\t {\n\t\tosgSocket = new Socket(osgServerName, Integer\n\t\t\t.parseInt(osgServerPort));\n\t\tif (osgSocket != null)\n\t\t{\n"
}
}
},
"message": {
"text": "osgSocket = new Socket(...)"
},
"annotations": [
{
"startLine": 93,
"startColumn": 3,
"message": {
"text": "osgSocket refers to an allocated resource"
}
}
]
},
"kinds": [
"call",
"function"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 95,
"snippet": {
"text": "\t\tif (osgSocket != null)"
}
},
"contextRegion": {
"startLine": 92,
"endLine": 98,
"snippet": {
"text": "\t {\n\t\tosgSocket = new Socket(osgServerName, Integer\n\t\t\t.parseInt(osgServerPort));\n\t\tif (osgSocket != null)\n\t\t{\n\t\t out = new PrintWriter(osgSocket.getOutputStream(), true);\n\t\t in = new BufferedReader(new InputStreamReader(osgSocket\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 97,
"snippet": {
"text": "\t\t out = new PrintWriter(osgSocket.getOutputStream(), true);"
}
},
"contextRegion": {
"startLine": 94,
"endLine": 100,
"snippet": {
"text": "\t\t\t.parseInt(osgServerPort));\n\t\tif (osgSocket != null)\n\t\t{\n\t\t out = new PrintWriter(osgSocket.getOutputStream(), true);\n\t\t in = new BufferedReader(new InputStreamReader(osgSocket\n\t\t\t .getInputStream()));\n\t\t //String message = \"HTTPRECEIVEHTTPREQUEST,-,DataValidation_SqlInjection_Basic.aspx\";\n"
}
}
},
"message": {
"text": "osgSocket.getOutputStream()"
}
},
"kinds": [
"acquire",
"resource"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 97,
"snippet": {
"text": "\t\t out = new PrintWriter(osgSocket.getOutputStream(), true);"
}
},
"contextRegion": {
"startLine": 94,
"endLine": 100,
"snippet": {
"text": "\t\t\t.parseInt(osgServerPort));\n\t\tif (osgSocket != null)\n\t\t{\n\t\t out = new PrintWriter(osgSocket.getOutputStream(), true);\n\t\t in = new BufferedReader(new InputStreamReader(osgSocket\n\t\t\t .getInputStream()));\n\t\t //String message = \"HTTPRECEIVEHTTPREQUEST,-,DataValidation_SqlInjection_Basic.aspx\";\n"
}
}
},
"message": {
"text": "java.io.IOException thrown"
}
},
"kinds": [
"unknown"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 97,
"snippet": {
"text": "\t\t out = new PrintWriter(osgSocket.getOutputStream(), true);"
}
},
"contextRegion": {
"startLine": 94,
"endLine": 100,
"snippet": {
"text": "\t\t\t.parseInt(osgServerPort));\n\t\tif (osgSocket != null)\n\t\t{\n\t\t out = new PrintWriter(osgSocket.getOutputStream(), true);\n\t\t in = new BufferedReader(new InputStreamReader(osgSocket\n\t\t\t .getInputStream()));\n\t\t //String message = \"HTTPRECEIVEHTTPREQUEST,-,DataValidation_SqlInjection_Basic.aspx\";\n"
}
}
},
"message": {
"text": "osgSocket no longer refers to an allocated resource"
}
},
"kinds": [
"exit",
"scope"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 123,
"snippet": {
"text": "\t if (in != null)"
}
},
"contextRegion": {
"startLine": 120,
"endLine": 126,
"snippet": {
"text": "\t {\n\t\tout.close();\n\t }\n\t if (in != null)\n\t {\n\t\tin.close();\n\t }\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 125,
"snippet": {
"text": "\t\tin.close();"
}
},
"contextRegion": {
"startLine": 122,
"endLine": 128,
"snippet": {
"text": "\t }\n\t if (in != null)\n\t {\n\t\tin.close();\n\t }\n\t if (osgSocket != null)\n\t {\n"
}
}
},
"message": {
"text": "java.io.IOException thrown"
}
},
"kinds": [
"unknown"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 125,
"snippet": {
"text": "\t\tin.close();"
}
},
"contextRegion": {
"startLine": 122,
"endLine": 128,
"snippet": {
"text": "\t }\n\t if (in != null)\n\t {\n\t\tin.close();\n\t }\n\t if (osgSocket != null)\n\t {\n"
}
}
},
"message": {
"text": "throw"
}
},
"kinds": [
"return",
"function"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 125,
"snippet": {
"text": "\t\tin.close();"
}
},
"contextRegion": {
"startLine": 122,
"endLine": 128,
"snippet": {
"text": "\t }\n\t if (in != null)\n\t {\n\t\tin.close();\n\t }\n\t if (osgSocket != null)\n\t {\n"
}
}
},
"message": {
"text": "osgSocket no longer refers to an allocated resource"
}
},
"kinds": [
"exit",
"scope"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 125,
"snippet": {
"text": "\t\tin.close();"
}
},
"contextRegion": {
"startLine": 122,
"endLine": 128,
"snippet": {
"text": "\t }\n\t if (in != null)\n\t {\n\t\tin.close();\n\t }\n\t if (osgSocket != null)\n\t {\n"
}
}
},
"message": {
"text": "osgSocket end scope : Resource leaked : java.io.IOException thrown"
}
},
"kinds": [
"exit",
"scope"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 39
},
"region": {
"startLine": 97
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 142,
"message": {
"text": "The call to equals() on line [104](1) causes portability problems because it has different locales which may lead to unexpected output. This may also circumvent custom validation routines.\r\nUnexpected portability problems can be found when the locale is not specified."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 104,
"snippet": {
"text": "\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")"
}
},
"contextRegion": {
"startLine": 101,
"endLine": 107,
"snippet": {
"text": "\t\t\t|| (helpFile.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase().equals(\"netstat -a #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 77,
"snippet": {
"text": "\t if (s.isDefuseOSCommands()"
}
},
"contextRegion": {
"startLine": 74,
"endLine": 80,
"snippet": {
"text": "\t String helpFile = s.getParser().getRawParameter(HELP_FILE,\n\t\t \"BasicAuthentication.help\");\n\t String safeDirName;\n\t if (s.isDefuseOSCommands()\n\t\t && (helpFile.indexOf('&') != -1 || helpFile.indexOf(';') != -1))\n\t {\n\t\tint index = helpFile.indexOf('&');\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 78,
"snippet": {
"text": "\t\t && (helpFile.indexOf('&') != -1 || helpFile.indexOf(';') != -1))"
}
},
"contextRegion": {
"startLine": 75,
"endLine": 81,
"snippet": {
"text": "\t\t \"BasicAuthentication.help\");\n\t String safeDirName;\n\t if (s.isDefuseOSCommands()\n\t\t && (helpFile.indexOf('&') != -1 || helpFile.indexOf(';') != -1))\n\t {\n\t\tint index = helpFile.indexOf('&');\n\t\tif (index == -1)\n"
}
}
},
"message": {
"text": "Branch taken"
}
},
"kinds": [
"branch",
"true"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 90,
"snippet": {
"text": "\t\tif ((osName.indexOf(\"Windows\") != -1 && (helpFile.substring("
}
},
"contextRegion": {
"startLine": 87,
"endLine": 93,
"snippet": {
"text": "\t\tSystem.out.println(\"Command = [\"\n\t\t\t+ helpFile.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase() + \"]\");\n\t\tif ((osName.indexOf(\"Windows\") != -1 && (helpFile.substring(\n\t\t\tindex, helpFileLen).trim().toLowerCase().equals(\n\t\t\t\"netstat -a\")\n\t\t\t|| helpFile.substring(index, helpFileLen).trim()\n"
}
}
},
"message": {
"text": "Branch not taken"
}
},
"kinds": [
"branch",
"false"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 102,
"snippet": {
"text": "\t\t\t\t.toLowerCase().equals(\"netstat -a #\")"
}
},
"contextRegion": {
"startLine": 99,
"endLine": 105,
"snippet": {
"text": "\t\t\t.substring(index, helpFileLen).trim().toLowerCase()\n\t\t\t.equals(\"ipconfig\")))\n\t\t\t|| (helpFile.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase().equals(\"netstat -a #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n"
}
}
},
"message": {
"text": "Branch not taken"
}
},
"kinds": [
"branch",
"false"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 104,
"snippet": {
"text": "\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")"
}
},
"contextRegion": {
"startLine": 101,
"endLine": 107,
"snippet": {
"text": "\t\t\t|| (helpFile.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase().equals(\"netstat -a #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n"
}
}
},
"message": {
"text": "toLowerCase() : Case changed using default locale"
}
},
"kinds": [
"acquire",
"resource"
]
},
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 104,
"snippet": {
"text": "\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")"
}
},
"contextRegion": {
"startLine": 101,
"endLine": 107,
"snippet": {
"text": "\t\t\t|| (helpFile.substring(index, helpFileLen).trim()\n\t\t\t\t.toLowerCase().equals(\"netstat -a #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"dir #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n\t\t\t\t\t.trim().toLowerCase().equals(\"ls #\")\n\t\t\t\t|| helpFile.substring(index, helpFileLen)\n"
}
}
},
"message": {
"text": "helpFile.substring(index, helpFileLen).trim().toLowerCase().equals(...) : Comparison without checking locale"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 29
},
"region": {
"startLine": 104
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 17,
"message": {
"text": "The catch block at [ThreadSafetyProblem.java](1) line [125](1) handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.\r\nThe catch block handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 12
},
"region": {
"startLine": 125,
"endLine": 129,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\r\n\t e.printStackTrace();\r\n\t}"
}
},
"contextRegion": {
"startLine": 122,
"endLine": 132,
"snippet": {
"text": "\t }\n\n\t}\n\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\n\treturn (ec);\n }\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 12
},
"region": {
"startLine": 125,
"endLine": 129,
"snippet": {
"text": "\tcatch (Exception e)\r\n\t{\r\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\r\n\t e.printStackTrace();\r\n\t}"
}
},
"contextRegion": {
"startLine": 122,
"endLine": 132,
"snippet": {
"text": "\t }\n\n\t}\n\tcatch (Exception e)\n\t{\n\t s.setMessage(\"Error generating \" + this.getClass().getName());\n\t e.printStackTrace();\n\t}\n\n\treturn (ec);\n }\n"
}
}
},
"message": {
"text": "CatchBlock"
}
},
"kinds": [
"unknown"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 12
},
"region": {
"startLine": 125,
"startColumn": 2,
"endLine": 129
}
}
}
],
"properties": {
"InstanceSeverity": "2.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 78,
"message": {
"text": "The function getEmployeeProfile_BACKUP() in [ViewProfile.java](1) might reveal system data or debugging information by calling printStackTrace() on line [220](1). The information revealed by printStackTrace() could help an adversary form a plan of attack.\r\nRevealing system data or debugging information helps an adversary learn about the system and form a plan of attack."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 66
},
"region": {
"startLine": 220,
"snippet": {
"text": "\t\tsqle.printStackTrace();"
}
},
"contextRegion": {
"startLine": 217,
"endLine": 223,
"snippet": {
"text": "\t catch (SQLException sqle)\n\t {\n\t\ts.setMessage(\"Error getting employee profile\");\n\t\tsqle.printStackTrace();\n\t }\n\t}\n\tcatch (Exception e)\n"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"index": 66
},
"region": {
"startLine": 220,
"snippet": {
"text": "\t\tsqle.printStackTrace();"
}
},
"contextRegion": {
"startLine": 217,
"endLine": 223,
"snippet": {
"text": "\t catch (SQLException sqle)\n\t {\n\t\ts.setMessage(\"Error getting employee profile\");\n\t\tsqle.printStackTrace();\n\t }\n\t}\n\tcatch (Exception e)\n"
}
}
},
"message": {
"text": "printStackTrace()"
}
},
"kinds": [
"call",
"function"
]
}
]
}
]
}
],
"relatedLocations": [
{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"index": 66
},
"region": {
"startLine": 220
}
}
}
],
"properties": {
"InstanceSeverity": "3.0",
"Confidence": "5.0"
}
},
{
"ruleIndex": 36,
"level": "error",
"message": {
"text": "The method _jspService() in [EditProfile.jsp](1) sends unvalidated data to a web browser on line [8](1), which can result in the browser executing malicious code.\r\nSending unvalidated data to a web browser can result in the browser executing malicious code."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"index": 112
},
"region": {
"startLine": 8,
"snippet": {
"text": "\t\t Welcome Back <%=webSession.getUserNameInLesson()%> - Edit Profile Page "
}
},
"contextRegion": {
"startLine": 5,
"endLine": 11,
"snippet": {
"text": "\tWebSession webSession = ((WebSession)session.getAttribute(\"websession\"));\n\tEmployee employee = (Employee) session.getAttribute(\"RoleBasedAccessControl.Employee\");\n%>\n\t\tWelcome Back <%=webSession.getUserNameInLesson()%> - Edit Profile Page \n\t\t | | | | |