View Source

Recommendations

FIO00-J. Validate deserialized objects

FIO01-J. Canonicalize path names originating from untrusted sources

FIO02-J. Use Runtime.exec() correctly

FIO03-J. Keep track of bytes read and account for character encoding while reading data

FIO04-J. Do not depend on user supplied encoded data

FIO05-J. Document character encoding while performing file or network IO

FIO06-J. Validate user input

FIO07-J. Do not assume infinite heap space

Rules

FIO30-J. Reserved

FIO31-J. Create a copy of mutable inputs

FIO32-J. Do not serialize sensitive data

FIO33-J. Do not allow serialization and deserialization to bypass the Security Manager

FIO34-J. Ensure all resources are properly closed when they are no longer needed

FIO35-J. Exclude user input from format strings

FIO36-J. Never hardcode sensitive information

FIO37-J. Create and delete temporary files safely

Risk Assessment Summary

Recommendations

Recommendation	Severity	Likelihood	Remediation Cost	Priority	Level
FIO00-J	medium	probable	high	P4	L3
FIO01-J	medium	unlikely	medium	P4	L3
FIO02-J	medium	unlikely	medium	P4	L3
FIO03-J	low	unlikely	medium	P2	L3
FIO04-J	TODO	TODO	TODO	TODO	TODO
FIO05-J	TODO	TODO	TODO	TODO	TODO
FIO06-J	medium	probable	high	P4	L3
FIO07-J	medium	probable	high	P4	L3

Rules

Rules	Severity	Likelihood	Remediation Cost	Priority	Level
FIO30-J	TODO	TODO	TODO	TODO	TODO
FIO31-J	medium	probable	high	P4	L3
FIO32-J	medium	likely	high	P6	L2
FIO33-J	high	probable	high	P6	L2
FIO34-J	low	probable	medium	P4	L3
FIO35-J	medium	unlikely	medium	P4	L3
FIO36-J	high	probable	medium	P12	L1
FIO37-J	medium	probable	high	P4	L3

OBJ35-J. Use checked collections against external code The CERT Sun Microsystems Secure Coding Standard for Java FIO00-J. Validate deserialized objects