All Guidelines with Classification

Guidelines

Security

• Page:
  FIO52-J. Do not store unencrypted sensitive information on the client side
• Page:
  IDS51-J. Properly encode or escape output
• Page:
  IDS52-J. Prevent code injection
• Page:
  IDS53-J. Prevent XPath Injection
• Page:
  IDS54-J. Prevent LDAP injection
• Page:
  IDS56-J. Prevent arbitrary file upload
• Page:
  MET52-J. Do not use the clone() method to copy untrusted method parameters
• Page:
  MET56-J. Do not use Object.equals() to compare cryptographic keys
• Page:
  MSC59-J. Limit the lifetime of sensitive data
• Page:
  MSC61-J. Do not use insecure or weak cryptographic algorithms
• Page:
  MSC62-J. Store passwords using a hash function
• Page:
  MSC63-J. Ensure that SecureRandom is properly seeded
• Page:
  OBJ56-J. Provide sensitive mutable classes with unmodifiable wrappers
• Page:
  OBJ57-J. Do not rely on methods that can be overridden by untrusted code
• Page:
  SEC50-J. Avoid granting excess privileges
• Page:
  SEC51-J. Minimize privileged code
• Page:
  SEC52-J. Do not expose methods that use reduced-security checks to untrusted code
• Page:
  SEC53-J. Define custom security permissions for fine-grained security
• Page:
  SEC54-J. Create a secure sandbox using a security manager
• Page:
  SEC55-J. Ensure that security-sensitive methods are called with validated arguments
• Page:
  SEC57-J. Do not let untrusted code misuse privileges of callback methods

Defensive Programming

• Page:
  CON52-J. Document thread-safety and use annotations where applicable
• Page:
  DCL53-J. Minimize the scope of variables
• Page:
  DCL56-J. Do not attach significance to the ordinal associated with an enum
• Page:
  DCL58-J. Enable compile-time type checking of variable arity parameter types
• Page:
  DCL59-J. Do not apply public final to constants whose value might change in later releases
• Page:
  DCL60-J. Avoid cyclic dependencies between packages
• Page:
  ERR51-J. Prefer user-defined exceptions over more general exception types
• Page:
  ERR53-J. Try to gracefully recover from system errors
• Page:
  FIO51-J. Identify files using multiple file attributes
• Page:
  MET54-J. Always provide feedback about the resulting value of a method
• Page:
  MSC50-J. Minimize the scope of the @SuppressWarnings annotation
• Page:
  MSC53-J. Carefully design interfaces before releasing them
• Page:
  NUM52-J. Be aware of numeric promotion behavior
• Page:
  OBJ51-J. Minimize the accessibility of classes and their members
• Page:
  OBJ52-J. Write garbage-collection-friendly code

Bad Practices

Programming Oversights

• Page:
  DCL50-J. Use visually distinct identifiers
• Page:
  DCL57-J. Avoid ambiguous overloading of variable arity methods
• Page:
  ERR52-J. Avoid in-band error indicators
• Page:
  EXP51-J. Do not perform assignments in conditional expressions
• Page:
  EXP52-J. Use braces for the body of an if, for, or while statement
• Page:
  EXP53-J. Use parentheses for precedence of operation
• Page:
  FIO50-J. Do not make assumptions about file creation
• Page:
  MET53-J. Ensure that the clone() method calls super.clone()
• Page:
  MSC51-J. Do not place a semicolon immediately following an if, for, or while condition
• Page:
  MSC52-J. Finish every set of statements associated with a case label with a break statement
• Page:
  MSC54-J. Avoid inadvertent wrapping of loop counters
• Page:
  MSC55-J. Use comments consistently and in a readable fashion
• Page:
  MSC56-J. Detect and remove superfluous code and values
• Page:
  MSC57-J. Strive for logical completeness
• Page:
  NUM50-J. Convert integers to floating point for floating-point operations

Language Misconceptions

• Page:
  CON50-J. Do not assume that declaring a reference volatile guarantees safe publication of the members of the referenced object
• Page:
  CON51-J. Do not assume that the sleep(), yield(), or getState() methods provide synchronization semantics
• Page:
  EXP50-J. Do not confuse abstract object equality with reference equality
• Page:
  EXP54-J. Understand the differences between bitwise and logical operators
• Page:
  FIO53-J. Use the serialization methods writeUnshared() and readUnshared() with care
• Page:
  IDS55-J. Understand how escape characters are interpreted when strings are loaded
• Page:
  MET50-J. Avoid ambiguous or confusing uses of overloading
• Page:
  MET51-J. Do not use overloaded methods to differentiate between runtime types
• Page:
  NUM51-J. Do not assume that the remainder operator always returns a nonnegative result for integral operands
• Page:
  OBJ50-J. Never confuse the immutability of a reference with that of the referenced object
• Page:
  OBJ54-J. Do not attempt to help the garbage collector by setting local reference variables to null