Apache RAT
MavenSpotBugs Bug Detector Report
The following document contains the results of SpotBugs
SpotBugs Version is 4.10.5
Threshold is medium
Effort is default
Summary
| Classes | Bugs | Errors | Missing Classes |
|---|---|---|---|
| 10621 | 151 | 0 | 164 |
Files
org.apache.rat.anttasks.Report$ApprovalFilter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.anttasks.Report$ApprovalFilter at new org.apache.rat.anttasks.Report$ApprovalFilter(String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 524 | Medium |
org.apache.rat.OptionCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
org.apache.rat.ReportConfiguration$SerDes
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
org.apache.rat.Reporter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
org.apache.rat.Reporter$Output$Builder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
org.apache.rat.analysis.HeaderCheckWorker
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
org.apache.rat.analysis.matchers.AbstractMatcherContainer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
org.apache.rat.analysis.matchers.NotMatcher
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
org.apache.rat.commandline.ArgumentContext
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
org.apache.rat.config.parameters.Description
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
org.apache.rat.configuration.MatcherBuilderTracker
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
org.apache.rat.configuration.XMLConfigurationReader
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
org.apache.rat.configuration.XMLConfigurationWriter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
org.apache.rat.configuration.builders.ChildContainerBuilder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
org.apache.rat.license.SimpleLicense
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
org.apache.rat.report.claim.ClaimAggregator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
org.apache.rat.report.claim.ClaimStatistic$SerDes
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
org.apache.rat.ui.UIOption
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
org.apache.rat.ui.UIOption$Builder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
org.apache.rat.ui.UIOptionCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
org.apache.rat.utils.CasedString
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
org.apache.rat.utils.FileUtils
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
org.apache.rat.OptionCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
org.apache.rat.ReportConfiguration$SerDes
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
org.apache.rat.Reporter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
org.apache.rat.Reporter$Output$Builder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
org.apache.rat.analysis.HeaderCheckWorker
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
org.apache.rat.analysis.matchers.AbstractMatcherContainer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
org.apache.rat.analysis.matchers.NotMatcher
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
org.apache.rat.commandline.ArgumentContext
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
org.apache.rat.config.parameters.Description
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
org.apache.rat.configuration.MatcherBuilderTracker
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
org.apache.rat.configuration.XMLConfigurationReader
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
org.apache.rat.configuration.XMLConfigurationWriter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
org.apache.rat.configuration.builders.ChildContainerBuilder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
org.apache.rat.documentation.velocity.Matcher
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 79 | Medium |
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(Description, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 88 | Medium |
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 79 | Medium |
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(Description, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 88 | Medium |
org.apache.rat.license.SimpleLicense
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
org.apache.rat.report.claim.ClaimAggregator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
org.apache.rat.report.claim.ClaimStatistic$SerDes
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
org.apache.rat.tools.AntGenerator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.AntGenerator.main(String[]) | BAD_PRACTICE | RV_RETURN_VALUE_IGNORED_BAD_PRACTICE | 137 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.getElementClass(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 229 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.main(String[]) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 171 | Medium |
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.AntGenerator.main(String[]) | BAD_PRACTICE | RV_RETURN_VALUE_IGNORED_BAD_PRACTICE | 137 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.getElementClass(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 229 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.main(String[]) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 171 | Medium |
org.apache.rat.tools.AntGenerator$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$1.getMethod(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 70 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$1.getMethod(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 70 | Medium |
org.apache.rat.tools.AntGenerator$GenerateType
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getMethod(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 249 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getPattern(AntOption, AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 267 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getMethod(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 249 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getPattern(AntOption, AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 267 | Medium |
org.apache.rat.tools.MavenGenerator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.MavenGenerator.main(String[]) | BAD_PRACTICE | RV_RETURN_VALUE_IGNORED_BAD_PRACTICE | 83 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.MavenGenerator.main(String[]) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 112 | Medium |
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.MavenGenerator.main(String[]) | BAD_PRACTICE | RV_RETURN_VALUE_IGNORED_BAD_PRACTICE | 83 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.MavenGenerator.main(String[]) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 112 | Medium |
org.apache.rat.ui.UIOption
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
org.apache.rat.ui.UIOption$Builder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
org.apache.rat.ui.UIOptionCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
org.apache.rat.utils.CasedString
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
org.apache.rat.utils.FileUtils
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
org.apache.rat.utils.Log
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Possible information exposure through an error message | SECURITY | INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE | 52 | Medium |
| Possible information exposure through an error message | SECURITY | INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE | 52 | Medium |
org.apache.rat.OptionCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
org.apache.rat.ReportConfiguration$SerDes
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
org.apache.rat.Reporter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
org.apache.rat.Reporter$Output$Builder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
org.apache.rat.analysis.HeaderCheckWorker
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
org.apache.rat.analysis.matchers.AbstractMatcherContainer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
org.apache.rat.analysis.matchers.NotMatcher
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
org.apache.rat.commandline.ArgumentContext
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
org.apache.rat.config.parameters.Description
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
org.apache.rat.configuration.MatcherBuilderTracker
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
org.apache.rat.configuration.XMLConfigurationReader
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
org.apache.rat.configuration.XMLConfigurationWriter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
org.apache.rat.configuration.builders.ChildContainerBuilder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
org.apache.rat.license.SimpleLicense
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
org.apache.rat.report.claim.ClaimAggregator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
org.apache.rat.report.claim.ClaimStatistic$SerDes
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
org.apache.rat.ui.UIOption
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
org.apache.rat.ui.UIOption$Builder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
org.apache.rat.ui.UIOptionCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
org.apache.rat.utils.CasedString
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
org.apache.rat.utils.FileUtils
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
org.apache.rat.OptionCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
| Static synchronized method org.apache.rat.OptionCollection.parseCommands(File, String[], Consumer, boolean) uses intrinsic lock of class org.apache.rat.OptionCollection for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 150 | Medium |
org.apache.rat.ReportConfiguration$SerDes
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 1044 | Medium |
org.apache.rat.Reporter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
| new org.apache.rat.Reporter(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 75 | Medium |
org.apache.rat.Reporter$Output$Builder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
| org.apache.rat.Reporter$Output$Builder.configuration(ReportConfiguration) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 296 | Medium |
| org.apache.rat.Reporter$Output$Builder.document(Document) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.document | MALICIOUS_CODE | EI_EXPOSE_REP2 | 260 | Medium |
| org.apache.rat.Reporter$Output$Builder.statistic(ClaimStatistic) may expose internal representation by storing an externally mutable object into Reporter$Output$Builder.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 279 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 267 | Medium |
org.apache.rat.analysis.HeaderCheckWorker
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
| new org.apache.rat.analysis.HeaderCheckWorker(IHeaderMatcher, Reader, int, UnmodifiableSortedSet, Document) may expose internal representation by storing an externally mutable object into HeaderCheckWorker.licenses | MALICIOUS_CODE | EI_EXPOSE_REP2 | 134 | Medium |
org.apache.rat.analysis.matchers.AbstractMatcherContainer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(String, Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 56 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.AbstractMatcherContainer at new org.apache.rat.analysis.matchers.AbstractMatcherContainer(Collection, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 70 | Medium |
org.apache.rat.analysis.matchers.NotMatcher
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.NotMatcher at new org.apache.rat.analysis.matchers.NotMatcher(String, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 49 | Medium |
org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
| Exception thrown in class org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match at new org.apache.rat.analysis.matchers.SPDXMatcherFactory$Match(SPDXMatcherFactory, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 185 | Medium |
org.apache.rat.commandline.ArgumentContext
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
| new org.apache.rat.commandline.ArgumentContext(File, ReportConfiguration, Options, String[]) may expose internal representation by storing an externally mutable object into ArgumentContext.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 70 | Medium |
org.apache.rat.config.parameters.Description
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ComponentType, String, String, boolean, Class, Collection, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 85 | Medium |
| Exception thrown in class org.apache.rat.config.parameters.Description at new org.apache.rat.config.parameters.Description(ConfigComponent, boolean, Class, Collection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 107 | Medium |
org.apache.rat.configuration.MatcherBuilderTracker
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
| Public static org.apache.rat.configuration.MatcherBuilderTracker.instance() may expose internal representation by returning MatcherBuilderTracker.instance | MALICIOUS_CODE | MS_EXPOSE_REP | 55 | Medium |
| Method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, that is exposed by static org.apache.rat.configuration.MatcherBuilderTracker.instance()Lorg/apache/rat/configuration/MatcherBuilderTracker;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 51 | Medium |
| Static synchronized method org.apache.rat.configuration.MatcherBuilderTracker.instance() uses intrinsic lock of class org.apache.rat.configuration.MatcherBuilderTracker for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 51 | Medium |
org.apache.rat.configuration.XMLConfigurationReader
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
| This web server request could be used by an attacker to expose internal services and filesystem. | SECURITY | URLCONNECTION_SSRF_FD | 162 | Medium |
org.apache.rat.configuration.XMLConfigurationWriter
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
| new org.apache.rat.configuration.XMLConfigurationWriter(ReportConfiguration) may expose internal representation by storing an externally mutable object into XMLConfigurationWriter.configuration | MALICIOUS_CODE | EI_EXPOSE_REP2 | 62 | Medium |
org.apache.rat.configuration.builders.ChildContainerBuilder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
| Usage of GetResource in org.apache.rat.configuration.builders.ChildContainerBuilder.setResource(String) may be unsafe if class is extended | BAD_PRACTICE | UI_INHERITANCE_UNSAFE_GETRESOURCE | 62 | Medium |
org.apache.rat.documentation.velocity.Matcher
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 79 | Medium |
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(Description, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 88 | Medium |
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 79 | Medium |
| Exception thrown in class org.apache.rat.documentation.velocity.Matcher at new org.apache.rat.documentation.velocity.Matcher(Description, IHeaderMatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 88 | Medium |
org.apache.rat.license.SimpleLicense
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
| Exception thrown in class org.apache.rat.license.SimpleLicense at new org.apache.rat.license.SimpleLicense(ILicenseFamily, IHeaderMatcher, String, String, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 57 | Medium |
org.apache.rat.report.claim.ClaimAggregator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
| new org.apache.rat.report.claim.ClaimAggregator(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimAggregator.statistic | MALICIOUS_CODE | EI_EXPOSE_REP2 | 41 | Medium |
org.apache.rat.report.claim.ClaimStatistic$SerDes
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
| new org.apache.rat.report.claim.ClaimStatistic$SerDes(ClaimStatistic) may expose internal representation by storing an externally mutable object into ClaimStatistic$SerDes.this$0 | MALICIOUS_CODE | EI_EXPOSE_REP2 | 311 | Medium |
| The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks | SECURITY | XXE_DOCUMENT | 374 | Medium |
org.apache.rat.tools.AntGenerator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.AntGenerator.main(String[]) | BAD_PRACTICE | RV_RETURN_VALUE_IGNORED_BAD_PRACTICE | 137 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.getElementClass(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 229 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.main(String[]) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 171 | Medium |
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.AntGenerator.main(String[]) | BAD_PRACTICE | RV_RETURN_VALUE_IGNORED_BAD_PRACTICE | 137 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.getElementClass(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 229 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator.main(String[]) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 171 | Medium |
org.apache.rat.tools.AntGenerator$1
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$1.getMethod(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 70 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$1.getMethod(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 70 | Medium |
org.apache.rat.tools.AntGenerator$GenerateType
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getMethod(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 249 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getPattern(AntOption, AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 267 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getMethod(AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 249 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.AntGenerator$GenerateType.getPattern(AntOption, AntOption) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 267 | Medium |
org.apache.rat.tools.MavenGenerator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.MavenGenerator.main(String[]) | BAD_PRACTICE | RV_RETURN_VALUE_IGNORED_BAD_PRACTICE | 83 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.MavenGenerator.main(String[]) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 112 | Medium |
| Exceptional return value of java.io.File.mkdirs() ignored in org.apache.rat.tools.MavenGenerator.main(String[]) | BAD_PRACTICE | RV_RETURN_VALUE_IGNORED_BAD_PRACTICE | 83 | Medium |
| Format string should use %n rather than \n in org.apache.rat.tools.MavenGenerator.main(String[]) | BAD_PRACTICE | VA_FORMAT_STRING_USES_NEWLINE | 112 | Medium |
org.apache.rat.ui.UIOption
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
| The regular expression "-?-([A-Za-z0-9]+-?)+" is vulnerable to a denial of service attack (ReDOS) | SECURITY | REDOS | 46 | Medium |
org.apache.rat.ui.UIOption$Builder
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
| org.apache.rat.ui.UIOption$Builder.option(Option) may expose internal representation by storing an externally mutable object into UIOption$Builder.option | MALICIOUS_CODE | EI_EXPOSE_REP2 | 345 | Medium |
| org.apache.rat.ui.UIOption$Builder.optionCollection(UIOptionCollection) may expose internal representation by storing an externally mutable object into UIOption$Builder.optionCollection | MALICIOUS_CODE | EI_EXPOSE_REP2 | 334 | Medium |
org.apache.rat.ui.UIOptionCollection
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
| Exception thrown in class org.apache.rat.ui.UIOptionCollection at new org.apache.rat.ui.UIOptionCollection(UIOptionCollection$Builder) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 62 | Medium |
org.apache.rat.utils.CasedString
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
| Initialization circularity between org.apache.rat.utils.CasedString and org.apache.rat.utils.CasedString$StringCase | STYLE | IC_INIT_CIRCULARITY | 43 | Medium |
org.apache.rat.utils.FileUtils
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
| Dead store to ignored in org.apache.rat.utils.FileUtils.mkDir(File) | STYLE | DLS_DEAD_LOCAL_STORE | 42 | Medium |
| Found reliance on default encoding in org.apache.rat.utils.FileUtils.writeFile(File, String, Iterable): new java.io.FileWriter(File) | I18N | DM_DEFAULT_ENCODING | 76 | High |
org.apache.rat.utils.Log
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Possible information exposure through an error message | SECURITY | INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE | 52 | Medium |
| Possible information exposure through an error message | SECURITY | INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE | 52 | Medium |