Skip to end of banner Go to start of banner

3 Recommendations

Skip to end of metadata

Created by Sandy Shrum, last modified by Will Snavely on Mar 22, 2018

Go to start of metadata

Sections

Page:

Rec. 00. Input Validation and Data Sanitization (IDS)
Page:

Rec. 01. Declarations and Initialization (DCL)
Page:

Rec. 02. Expressions (EXP)
Page:

Rec. 03. Numeric Types and Operations (NUM)
Page:

Rec. 04. Characters and Strings (STR)
Page:

Rec. 05. Object Orientation (OBJ)
Page:

Rec. 06. Methods (MET)
Page:

Rec. 07. Exceptional Behavior (ERR)
Page:

Rec. 13. Input Output (FIO)
Page:

Rec. 15. Platform Security (SEC)
Page:

Rec. 18. Concurrency (CON)
Page:

Rec. 49. Miscellaneous (MSC)

Recommendation Listing

Page:

CON50-J. Do not assume that declaring a reference volatile guarantees safe publication of the members of the referenced object
Page:

CON51-J. Do not assume that the sleep(), yield(), or getState() methods provide synchronization semantics
Page:

CON52-J. Document thread-safety and use annotations where applicable
Page:

DCL50-J. Use visually distinct identifiers
Page:

DCL51-J. Do not shadow or obscure identifiers in subscopes
Page:

DCL52-J. Do not declare more than one variable per declaration
Page:

DCL53-J. Minimize the scope of variables
Page:

DCL54-J. Use meaningful symbolic constants to represent literal values in program logic
Page:

DCL55-J. Properly encode relationships in constant definitions
Page:

DCL56-J. Do not attach significance to the ordinal associated with an enum
Page:

DCL57-J. Avoid ambiguous overloading of variable arity methods
Page:

DCL58-J. Enable compile-time type checking of variable arity parameter types
Page:

DCL59-J. Do not apply public final to constants whose value might change in later releases
Page:

DCL60-J. Avoid cyclic dependencies between packages
Page:

DCL61-J. Do not use raw types
Page:

ERR50-J. Use exceptions only for exceptional conditions
Page:

ERR51-J. Prefer user-defined exceptions over more general exception types
Page:

ERR52-J. Avoid in-band error indicators
Page:

ERR53-J. Try to gracefully recover from system errors
Page:

ERR54-J. Use a try-with-resources statement to safely handle closeable resources
Page:

EXP50-J. Do not confuse abstract object equality with reference equality
Page:

EXP51-J. Do not perform assignments in conditional expressions
Page:

EXP52-J. Use braces for the body of an if, for, or while statement
Page:

EXP53-J. Use parentheses for precedence of operation
Page:

EXP54-J. Understand the differences between bitwise and logical operators
Page:

EXP55-J. Use the same type for the second and third operands in conditional expressions
Page:

FIO50-J. Do not make assumptions about file creation
Page:

FIO51-J. Identify files using multiple file attributes
Page:

FIO52-J. Do not store unencrypted sensitive information on the client side
Page:

FIO53-J. Use the serialization methods writeUnshared() and readUnshared() with care
Page:

IDS50-J. Use conservative file naming conventions
Page:

IDS51-J. Properly encode or escape output
Page:

IDS52-J. Prevent code injection
Page:

IDS53-J. Prevent XPath Injection
Page:

IDS54-J. Prevent LDAP injection
Page:

IDS55-J. Understand how escape characters are interpreted when strings are loaded
Page:

IDS56-J. Prevent arbitrary file upload
Page:

MET50-J. Avoid ambiguous or confusing uses of overloading
Page:

MET51-J. Do not use overloaded methods to differentiate between runtime types
Page:

MET52-J. Do not use the clone() method to copy untrusted method parameters
Page:

MET53-J. Ensure that the clone() method calls super.clone()
Page:

MET54-J. Always provide feedback about the resulting value of a method
Page:

MET55-J. Return an empty array or collection instead of a null value for methods that return an array or collection
Page:

MET56-J. Do not use Object.equals() to compare cryptographic keys
Page:

MSC50-J. Minimize the scope of the @SuppressWarnings annotation
Page:

MSC51-J. Do not place a semicolon immediately following an if, for, or while condition
Page:

MSC52-J. Finish every set of statements associated with a case label with a break statement
Page:

MSC53-J. Carefully design interfaces before releasing them
Page:

MSC54-J. Avoid inadvertent wrapping of loop counters
Page:

MSC55-J. Use comments consistently and in a readable fashion
Page:

MSC56-J. Detect and remove superfluous code and values
Page:

MSC57-J. Strive for logical completeness
Page:

MSC58-J. Prefer using iterators over enumerations
Page:

MSC59-J. Limit the lifetime of sensitive data
Page:

MSC60-J. Do not use assertions to verify the absence of runtime errors
Page:

MSC61-J. Do not use insecure or weak cryptographic algorithms
Page:

MSC62-J. Store passwords using a hash function
Page:

MSC63-J. Ensure that SecureRandom is properly seeded
Page:

NUM50-J. Convert integers to floating point for floating-point operations
Page:

NUM51-J. Do not assume that the remainder operator always returns a nonnegative result for integral operands
Page:

NUM52-J. Be aware of numeric promotion behavior
Page:

NUM53-J. Use the strictfp modifier for floating-point calculation consistency across platforms
Page:

NUM54-J. Do not use denormalized numbers
Page:

OBJ50-J. Never confuse the immutability of a reference with that of the referenced object
Page:

OBJ51-J. Minimize the accessibility of classes and their members
Page:

OBJ52-J. Write garbage-collection-friendly code
Page:

OBJ53-J. Do not use direct buffers for short-lived, infrequently used objects
Page:

OBJ54-J. Do not attempt to help the garbage collector by setting local reference variables to null
Page:

OBJ55-J. Remove short-lived objects from long-lived container objects
Page:

OBJ56-J. Provide sensitive mutable classes with unmodifiable wrappers
Page:

OBJ57-J. Do not rely on methods that can be overridden by untrusted code
Page:

OBJ58-J. Limit the extensibility of classes and methods with invariants
Page:

Rec. AA. References
Page:

Rec. BB. Definitions
Page:

Rule or Rec. CC. Analyzers
Page:

Rule or Rec. DD. Related Guidelines
Page:

Rule or Rec. EE. Risk Assessments
Page:

SEC50-J. Avoid granting excess privileges
Page:

SEC51-J. Minimize privileged code
Page:

SEC52-J. Do not expose methods that use reduced-security checks to untrusted code
Page:

SEC53-J. Define custom security permissions for fine-grained security
Page:

SEC54-J. Create a secure sandbox using a security manager
Page:

SEC55-J. Ensure that security-sensitive methods are called with validated arguments
Page:

SEC56-J. Do not serialize direct handles to system resources
Page:

SEC57-J. Do not let untrusted code misuse privileges of callback methods
Page:

SEC58-J. Deserialization methods should not perform potentially dangerous operations
Page:

STR50-J. Use the appropriate method for counting characters in a string
Page:

STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required

recommendation
section-list

Space shortcuts

Page tree

Sections

Recommendation Listing