...
Historically, using a narrow type to capture the return value of a byte input method has resulted in significant vulnerabilities, including command injection attacks; see CA-1996-22 advisory. Consequently, the severity of this error is high.
Rule | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
FIO08-J | High | Probable |
Yes | Yes |
P18 | L1 |
Automated Detection
Some static analysis tools can detect violations of this rule.
| Tool | Version | Checker | Description |
|---|---|---|---|
| Parasoft Jtest |
|
|
|
| CERT. |
| FIO08.CRRV |
| Check the return value of methods which read or skip input | |||||||||
| SpotBugs |
| EOS_BAD_END_OF_STREAM_CHECK | Implemented (since 4.4.0) |
Related Guidelines
Bibliography
...
...