Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Rule

Severity

Likelihood

Detectable

Repairable

Priority

Level

MSC00-J

Medium

Likely

No

No

P6

L2

Automated Detection

The general case of automated detection appears to be infeasible because determining which specific data may be passed through the socket is not statically computable. An approach that introduces a custom API for passing sensitive data via secure sockets may be feasible. User tagging of sensitive data is a necessary requirement for such an approach.

ToolVersionCheckerDescription
Parasoft Jtest
Include Page
Parasoft_V
Parasoft_V
SECURITY.WSC.USCUse the SSL-enabled version of classes when possible
Security Reviewer - Static Reviewer

Include Page
Security Reviewer - Static Reviewer_V
Security Reviewer - Static Reviewer_V

JAVA_01Full Implementation

Related Guidelines

MITRE CWE

CWE-311, Failure to Encrypt Sensitive Data

...