SpotBugs Bug Detector Report
The following document contains the results of SpotBugs
SpotBugs Version is 4.10.3
Threshold is medium
Effort is default
Summary
| Classes |
Bugs |
Errors |
Missing Classes |
| 236 |
32 |
0 |
0 |
org.apache.rat.OptionCollection
| Bug |
Category |
Details |
Line |
Priority |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. |
SECURITY |
USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION |
144-178 |
Medium |
org.apache.rat.ReportConfiguration$SerDes
| Bug |
Category |
Details |
Line |
Priority |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks |
SECURITY |
XXE_DOCUMENT |
1021 |
Medium |
org.apache.rat.Reporter
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
75 |
Medium |
org.apache.rat.Reporter$Output$Builder
| Bug |
Category |
Details |
Line |
Priority |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
296 |
Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
260 |
Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
279 |
Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks |
SECURITY |
XXE_DOCUMENT |
267 |
Medium |
org.apache.rat.analysis.HeaderCheckWorker
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
134 |
Medium |
org.apache.rat.analysis.matchers.AbstractMatcherContainer
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
56 |
Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
70 |
Medium |
org.apache.rat.analysis.matchers.NotMatcher
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
49 |
Medium |
org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
185 |
Medium |
org.apache.rat.commandline.ArgumentContext
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, CommandLine) may expose internal representation by storing an externally mutable object into ArgumentContext.commandLine |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
53 |
Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, CommandLine) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
54 |
Medium |
org.apache.rat.config.parameters.Description
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
85 |
Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
107 |
Medium |
org.apache.rat.configuration.MatcherBuilderTracker
| Bug |
Category |
Details |
Line |
Priority |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance |
MALICIOUS_CODE |
MS_EXPOSE_REP |
55 |
Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. |
SECURITY |
USO_UNSAFE_METHOD_SYNCHRONIZATION |
51-55 |
Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. |
SECURITY |
USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION |
51-55 |
Medium |
org.apache.rat.configuration.XMLConfigurationReader
| Bug |
Category |
Details |
Line |
Priority |
| This web server request could be used by an attacker to expose internal services and filesystem. |
SECURITY |
URLCONNECTION_SSRF_FD |
162 |
Medium |
org.apache.rat.configuration.XMLConfigurationWriter
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
62 |
Medium |
org.apache.rat.configuration.builders.ChildContainerBuilder
| Bug |
Category |
Details |
Line |
Priority |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended |
BAD_PRACTICE |
UI_INHERITANCE_UNSAFE_GETRESOURCE |
62 |
Medium |
org.apache.rat.document.ArchiveEntryDocument
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.document.ArchiveEntryDocument(ArchiveEntryName, byte[], DocumentNameMatcher) may expose internal representation by storing an externally mutable object into ArchiveEntryDocument.contents |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
45 |
Medium |
org.apache.rat.license.SimpleLicense
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
57 |
Medium |
org.apache.rat.license.SimpleLicense$Builder
| Bug |
Category |
Details |
Line |
Priority |
| org.apache.rat.license.SimpleLicense$Builder.setLicenseFamilies(SortedSet) may expose internal representation by storing an externally mutable object into SimpleLicense$Builder.licenseFamilies |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
211 |
Medium |
org.apache.rat.report.claim.ClaimAggregator
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
41 |
Medium |
org.apache.rat.report.claim.ClaimStatistic$SerDes
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
311 |
Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks |
SECURITY |
XXE_DOCUMENT |
374 |
Medium |
org.apache.rat.ui.UIOption
| Bug |
Category |
Details |
Line |
Priority |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) |
SECURITY |
REDOS |
42 |
Medium |
org.apache.rat.ui.UIOptionCollection
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
65 |
Medium |
org.apache.rat.utils.CasedString
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.utils.CasedString(CasedString$StringCase, String[]) may expose internal representation by storing an externally mutable object into CasedString.segments |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
65 |
Medium |
org.apache.rat.utils.ReportingSet
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.utils.ReportingSet(SortedSet) may expose internal representation by storing an externally mutable object into ReportingSet.delegate |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
55 |
Medium |
Apache RAT
Maven