SpotBugs Bug Detector Report
The following document contains the results of SpotBugs
SpotBugs Version is 4.10.3
Threshold is medium
Effort is default
Summary
| Classes |
Bugs |
Errors |
Missing Classes |
| 4937 |
45 |
0 |
68 |
org.apache.rat.anttasks.Report$AddLicenseHeaders
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.anttasks.Report$AddLicenseHeaders at new org.apache.rat.anttasks.Report$AddLicenseHeaders(String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
496 |
Medium |
org.apache.rat.anttasks.Report$ApprovalFilter
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.anttasks.Report$ApprovalFilter at new org.apache.rat.anttasks.Report$ApprovalFilter(String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
521 |
Medium |
org.apache.rat.OptionCollection
| Bug |
Category |
Details |
Line |
Priority |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. |
SECURITY |
USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION |
144 |
Medium |
org.apache.rat.ReportConfiguration$SerDes
| Bug |
Category |
Details |
Line |
Priority |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks |
SECURITY |
XXE_DOCUMENT |
1021 |
Medium |
org.apache.rat.Reporter
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
75 |
Medium |
org.apache.rat.Reporter$Output$Builder
| Bug |
Category |
Details |
Line |
Priority |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
296 |
Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
260 |
Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
279 |
Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks |
SECURITY |
XXE_DOCUMENT |
267 |
Medium |
org.apache.rat.analysis.HeaderCheckWorker
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
134 |
Medium |
org.apache.rat.analysis.matchers.AbstractMatcherContainer
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
56 |
Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
70 |
Medium |
org.apache.rat.analysis.matchers.NotMatcher
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
49 |
Medium |
org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
185 |
Medium |
org.apache.rat.commandline.ArgumentContext
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, CommandLine) may expose internal representation by storing an externally mutable object into ArgumentContext.commandLine |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
53 |
Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, CommandLine) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
54 |
Medium |
org.apache.rat.config.parameters.Description
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
85 |
Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
107 |
Medium |
org.apache.rat.configuration.MatcherBuilderTracker
| Bug |
Category |
Details |
Line |
Priority |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance |
MALICIOUS_CODE |
MS_EXPOSE_REP |
55 |
Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. |
SECURITY |
USO_UNSAFE_METHOD_SYNCHRONIZATION |
51 |
Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. |
SECURITY |
USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION |
51 |
Medium |
org.apache.rat.configuration.XMLConfigurationReader
| Bug |
Category |
Details |
Line |
Priority |
| This web server request could be used by an attacker to expose internal services and filesystem. |
SECURITY |
URLCONNECTION_SSRF_FD |
162 |
Medium |
org.apache.rat.configuration.XMLConfigurationWriter
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
62 |
Medium |
org.apache.rat.configuration.builders.ChildContainerBuilder
| Bug |
Category |
Details |
Line |
Priority |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended |
BAD_PRACTICE |
UI_INHERITANCE_UNSAFE_GETRESOURCE |
62 |
Medium |
org.apache.rat.document.ArchiveEntryDocument
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.document.ArchiveEntryDocument(ArchiveEntryName, byte[], DocumentNameMatcher) may expose internal representation by storing an externally mutable object into ArchiveEntryDocument.contents |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
45 |
Medium |
org.apache.rat.documentation.velocity.Matcher
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
79 |
Medium |
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(Description, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
88 |
Medium |
org.apache.rat.license.SimpleLicense
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
57 |
Medium |
org.apache.rat.license.SimpleLicense$Builder
| Bug |
Category |
Details |
Line |
Priority |
| org.apache.rat.license.SimpleLicense$Builder.setLicenseFamilies(SortedSet) may expose internal representation by storing an externally mutable object into SimpleLicense$Builder.licenseFamilies |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
211 |
Medium |
org.apache.rat.report.claim.ClaimAggregator
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
41 |
Medium |
org.apache.rat.report.claim.ClaimStatistic$SerDes
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
311 |
Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks |
SECURITY |
XXE_DOCUMENT |
374 |
Medium |
org.apache.rat.tools.AntGenerator
| Bug |
Category |
Details |
Line |
Priority |
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.AntGenerator.main(String[]) |
BAD_PRACTICE |
RV_RETURN_VALUE_IGNORED_BAD_PRACTICE |
136 |
Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.getElementClass(AntOption) |
BAD_PRACTICE |
VA_FORMAT_STRING_USES_NEWLINE |
228 |
Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.main(String[]) |
BAD_PRACTICE |
VA_FORMAT_STRING_USES_NEWLINE |
170 |
Medium |
org.apache.rat.tools.AntGenerator$1
| Bug |
Category |
Details |
Line |
Priority |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$1.getMethod(AntOption) |
BAD_PRACTICE |
VA_FORMAT_STRING_USES_NEWLINE |
70 |
Medium |
org.apache.rat.tools.AntGenerator$GenerateType
| Bug |
Category |
Details |
Line |
Priority |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getMethod(AntOption) |
BAD_PRACTICE |
VA_FORMAT_STRING_USES_NEWLINE |
248 |
Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getPattern(AntOption, AntOption) |
BAD_PRACTICE |
VA_FORMAT_STRING_USES_NEWLINE |
266 |
Medium |
org.apache.rat.tools.MavenGenerator
| Bug |
Category |
Details |
Line |
Priority |
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.MavenGenerator.main(String[]) |
BAD_PRACTICE |
RV_RETURN_VALUE_IGNORED_BAD_PRACTICE |
80 |
Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.MavenGenerator.main(String[]) |
BAD_PRACTICE |
VA_FORMAT_STRING_USES_NEWLINE |
109 |
Medium |
org.apache.rat.ui.UIOption
| Bug |
Category |
Details |
Line |
Priority |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) |
SECURITY |
REDOS |
42 |
Medium |
org.apache.rat.ui.UIOptionCollection
| Bug |
Category |
Details |
Line |
Priority |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. |
BAD_PRACTICE |
CT_CONSTRUCTOR_THROW |
65 |
Medium |
org.apache.rat.utils.CasedString
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.utils.CasedString(CasedString$StringCase, String[]) may expose internal representation by storing an externally mutable object into CasedString.segments |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
65 |
Medium |
org.apache.rat.utils.ReportingSet
| Bug |
Category |
Details |
Line |
Priority |
| new org.apache.rat.utils.ReportingSet(SortedSet) may expose internal representation by storing an externally mutable object into ReportingSet.delegate |
MALICIOUS_CODE |
EI_EXPOSE_REP2 |
55 |
Medium |
Apache RAT
Maven