Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Recommendations

SEC00-J. Do not allow exceptions to transmit sensitive information

SEC01-J. Be careful using doPrivileged

SEC02-J. Beware of standard APIs that may bypass Security Manager checks

SEC03-J. Beware of standard APIs that may use the immediate caller's class loader instance

SEC04-A. Beware of standard APIs that perform access checks against the immediate caller

SEC05-J. Handle exceptions appropriately

Rules

SEC30-C. Always use a Security Manager

SEC31-C. Never grant AllPermission

SEC32-C. Do not grant ReflectPermission with action suppressAccessChecks

SEC33-C. Define wrappers around native methods

SEC34-C. Do not allow the unauthorized construction of sensitive classes

SEC35-C. Provide mutable classes with a clone method

SEC36-C. Ensure that the bytecode verifier is applied to all involved code upon any modification

Risk Assessment Summary

Rules

Rules

Content by Label
showLabelsfalse
max99
spacescom.atlassian.confluence.content.render.xhtml.model.resource.identifiers.SpaceResourceIdentifier@3bbaf8c
sorttitle
showSpacefalse
labels+sec, +rule, -void
cqllabel = "sec" and label = "rule" and label != "void" and space = currentSpace()

Risk Assessment Summary

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

SEC30SEC00-C J high Medium likely Likely

low

High

P6

L2

SEC01-JHighLikelyLow

P27

L1 SEC31

SEC02-C J medium High probable Probable medium Medium

P8 P12

L2 L1 SEC32

SEC03-C J low High unlikely Probable high Medium

P1 P12

L3

L1

SEC04-JHighProbableMedium

P12

L1

SEC05-JHighProbableMedium

P12

L1

SEC06-JHighProbableMedium

P12

L1

SEC07-JHighProbableLow

P18

L1

 

...

Image Added Image Added Image Added