SpotBugs Bug Detector Report
The following document contains the results of SpotBugs
SpotBugs Version is 4.9.8
Threshold is medium
Effort is default
Summary
| Classes |
Bugs |
Errors |
Missing Classes |
| 68 |
39 |
0 |
1 |
org.europa.together.application.JakartaMailClient
| Bug |
Category |
Details |
Line |
Priority |
| org.europa.together.application.JakartaMailClient.getMimeMessage() may expose internal representation by returning JakartaMailClient.message |
MALICIOUS_CODE |
EI_EXPOSE_REP |
202 |
Medium |
org.europa.together.application.JavaCryptoTools
| Bug |
Category |
Details |
Line |
Priority |
| org.europa.together.application.JavaCryptoTools.saveKeyPairToFile(String, KeyPair) may fail to clean up java.io.OutputStream on checked exception |
EXPERIMENTAL |
OBL_UNSATISFIED_OBLIGATION_EXCEPTION_EDGE |
101 |
Medium |
| This API (java/nio/file/Paths.get(Ljava/lang/String;[Ljava/lang/String;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
121 |
Medium |
| This API (java/nio/file/Paths.get(Ljava/lang/String;[Ljava/lang/String;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
136 |
Medium |
| This API (java/io/FileOutputStream.<init>(Ljava/lang/String;)V) writes to a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_OUT |
101 |
Medium |
| This API (java/io/FileOutputStream.<init>(Ljava/lang/String;)V) writes to a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_OUT |
107 |
Medium |
org.europa.together.application.JdbcActions
| Bug |
Category |
Details |
Line |
Priority |
| This use of java/sql/Statement.execute(Ljava/lang/String;)Z can be vulnerable to SQL injection (with JDBC) |
SECURITY |
SQL_INJECTION_JDBC |
105 |
High |
org.europa.together.application.LogbackLogger
| Bug |
Category |
Details |
Line |
Priority |
| This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
35 |
Medium |
org.europa.together.application.OpenPdfRenderer
| Bug |
Category |
Details |
Line |
Priority |
| This API (java/io/FileOutputStream.<init>(Ljava/lang/String;)V) writes to a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_OUT |
102 |
Medium |
| This API (java/io/FileOutputStream.<init>(Ljava/lang/String;)V) writes to a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_OUT |
54 |
Medium |
| java/lang/StringBuilder.append(Ljava/lang/String;)Ljava/lang/StringBuilder; is potentially injected into an XML string in method org.europa.together.application.OpenPdfRenderer.renderDocumentFromHtml(String, String). |
SECURITY |
POTENTIAL_XML_INJECTION |
83 |
Medium |
| java/lang/StringBuilder.append(Ljava/lang/String;)Ljava/lang/StringBuilder; is potentially injected into an XML string in method org.europa.together.application.OpenPdfRenderer.renderDocumentFromHtml(String, String). |
SECURITY |
POTENTIAL_XML_INJECTION |
85 |
Medium |
| java/lang/StringBuilder.append(Ljava/lang/String;)Ljava/lang/StringBuilder; is potentially injected into an XML string in method org.europa.together.application.OpenPdfRenderer.renderDocumentFromHtml(String, String). |
SECURITY |
POTENTIAL_XML_INJECTION |
92 |
Medium |
| java/lang/StringBuilder.append(Ljava/lang/String;)Ljava/lang/StringBuilder; is potentially injected into an XML string in method org.europa.together.application.OpenPdfRenderer.renderDocumentFromHtml(String, String). |
SECURITY |
POTENTIAL_XML_INJECTION |
96 |
Medium |
org.europa.together.application.PropertyFileReader
| Bug |
Category |
Details |
Line |
Priority |
| This API (java/nio/file/Paths.get(Ljava/lang/String;[Ljava/lang/String;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
108 |
Medium |
org.europa.together.application.SaxTools
| Bug |
Category |
Details |
Line |
Priority |
| A malicious XSLT could be provided to trigger remote code execution |
SECURITY |
MALICIOUS_XSLT |
100 |
Medium |
| The use of TransformerFactory.newInstance(...) (TransformerFactory) is vulnerable to XML External Entity attacks |
SECURITY |
XXE_DTD_TRANSFORM_FACTORY |
99 |
Medium |
| The use of SAXParser.parse(...) (SAXParser) is vulnerable to XML External Entity attacks |
SECURITY |
XXE_SAXPARSER |
147 |
Medium |
| The use of SAXParser.parse(...) (SAXParser) is vulnerable to XML External Entity attacks |
SECURITY |
XXE_SAXPARSER |
199 |
Medium |
| XML schema processing is vulnerable to XML External Entity attacks |
SECURITY |
XXE_SCHEMA_FACTORY |
137 |
High |
| XML schema processing is vulnerable to XML External Entity attacks |
SECURITY |
XXE_SCHEMA_FACTORY |
145 |
High |
| The use of TransformerFactory.newInstance(...) is vulnerable to XSLT External Entity attacks |
SECURITY |
XXE_XSLT_TRANSFORM_FACTORY |
99 |
Medium |
org.europa.together.application.ZxingGenerator
| Bug |
Category |
Details |
Line |
Priority |
| The 'yyyy-mm-dd hh:mm:ss' date format string may lead to unexpected behavior used in generateDataForCalendarEvent(String, ZonedDateTime, ZonedDateTime) |
BAD_PRACTICE |
FS_BAD_DATE_FORMAT_FLAG_COMBO |
104 |
Medium |
| The 'yyyy-mm-dd hh:mm:ss' date format string may lead to unexpected behavior used in generateDataForCalendarEvent(String, ZonedDateTime, ZonedDateTime) |
BAD_PRACTICE |
FS_BAD_DATE_FORMAT_FLAG_COMBO |
105 |
Medium |
| The 'yyyy-mm-dd hh:mm:ss' date format string may lead to unexpected behavior used in generateDataForvCard(Map) |
BAD_PRACTICE |
FS_BAD_DATE_FORMAT_FLAG_COMBO |
66 |
Medium |
| This API (java/nio/file/Paths.get(Ljava/lang/String;[Ljava/lang/String;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
131 |
Medium |
org.europa.together.application.internal.PdfReplacedElementFactory
| Bug |
Category |
Details |
Line |
Priority |
| This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
42 |
Medium |
| This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
44 |
Medium |
org.europa.together.application.internal.SaxDocumentHandler
| Bug |
Category |
Details |
Line |
Priority |
| This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
293 |
Medium |
org.europa.together.domain.Mail
| Bug |
Category |
Details |
Line |
Priority |
| This API (jakarta/activation/FileDataSource.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
93 |
Medium |
org.europa.together.service.LoggingService
| Bug |
Category |
Details |
Line |
Priority |
| This API (java/nio/file/Paths.get(Ljava/lang/String;[Ljava/lang/String;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
55 |
Medium |
| This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
69 |
Medium |
org.europa.together.utils.FileUtils
| Bug |
Category |
Details |
Line |
Priority |
| Possible null pointer dereference in org.europa.together.utils.FileUtils.listFileTree(File) due to return value of called method |
STYLE |
NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE |
282 |
Medium |
| Possible null pointer dereference in org.europa.together.utils.FileUtils.listFileTree(File) due to return value of called method |
STYLE |
NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE |
281 |
Medium |
| org.europa.together.utils.FileUtils.copyFile(File, File) may fail to clean up java.io.OutputStream on checked exception |
EXPERIMENTAL |
OBL_UNSATISFIED_OBLIGATION_EXCEPTION_EDGE |
258 |
Medium |
| This API (java/nio/file/Paths.get(Ljava/lang/String;[Ljava/lang/String;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
241 |
Medium |
| This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
114 |
Medium |
| This API (java/nio/file/Paths.get(Ljava/lang/String;[Ljava/lang/String;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input |
SECURITY |
PATH_TRAVERSAL_IN |
87 |
Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. |
SECURITY |
URLCONNECTION_SSRF_FD |
179 |
Medium |
Together Platform