Sections

• Page:
  Rec. 00. Input Validation and Data Sanitization (IDS)
• Page:
  Rec. 01. Declarations and Initialization (DCL)
• Page:
  Rec. 02. Expressions (EXP)
• Page:
  Rec. 03. Numeric Types and Operations (NUM)
• Page:
  Rec. 04. Characters and Strings (STR)
• Page:
  Rec. 05. Object Orientation (OBJ)
• Page:
  Rec. 06. Methods (MET)
• Page:
  Rec. 07. Exceptional Behavior (ERR)
• Page:
  Rec. 13. Input Output (FIO)
• Page:
  Rec. 15. Platform Security (SEC)
• Page:
  Rec. 18. Concurrency (CON)
• Page:
  Rec. 49. Miscellaneous (MSC)

Recommendation Listing

• Page:
  CON50-J. Do not assume that declaring a reference volatile guarantees safe publication of the members of the referenced object
• Page:
  CON51-J. Do not assume that the sleep(), yield(), or getState() methods provide synchronization semantics
• Page:
  CON52-J. Document thread-safety and use annotations where applicable
• Page:
  DCL50-J. Use visually distinct identifiers
• Page:
  DCL51-J. Do not shadow or obscure identifiers in subscopes
• Page:
  DCL52-J. Do not declare more than one variable per declaration
• Page:
  DCL53-J. Minimize the scope of variables
• Page:
  DCL54-J. Use meaningful symbolic constants to represent literal values in program logic
• Page:
  DCL55-J. Properly encode relationships in constant definitions
• Page:
  DCL56-J. Do not attach significance to the ordinal associated with an enum
• Page:
  DCL57-J. Avoid ambiguous overloading of variable arity methods
• Page:
  DCL58-J. Enable compile-time type checking of variable arity parameter types
• Page:
  DCL59-J. Do not apply public final to constants whose value might change in later releases
• Page:
  DCL60-J. Avoid cyclic dependencies between packages
• Page:
  DCL61-J. Do not use raw types
• Page:
  ERR50-J. Use exceptions only for exceptional conditions
• Page:
  ERR51-J. Prefer user-defined exceptions over more general exception types
• Page:
  ERR52-J. Avoid in-band error indicators
• Page:
  ERR53-J. Try to gracefully recover from system errors
• Page:
  ERR54-J. Use a try-with-resources statement to safely handle closeable resources
• Page:
  EXP50-J. Do not confuse abstract object equality with reference equality
• Page:
  EXP51-J. Do not perform assignments in conditional expressions
• Page:
  EXP52-J. Use braces for the body of an if, for, or while statement
• Page:
  EXP53-J. Use parentheses for precedence of operation
• Page:
  EXP54-J. Understand the differences between bitwise and logical operators
• Page:
  EXP55-J. Use the same type for the second and third operands in conditional expressions
• Page:
  FIO50-J. Do not make assumptions about file creation
• Page:
  FIO51-J. Identify files using multiple file attributes
• Page:
  FIO52-J. Do not store unencrypted sensitive information on the client side
• Page:
  FIO53-J. Use the serialization methods writeUnshared() and readUnshared() with care
• Page:
  IDS50-J. Use conservative file naming conventions
• Page:
  IDS51-J. Properly encode or escape output
• Page:
  IDS52-J. Prevent code injection
• Page:
  IDS53-J. Prevent XPath Injection
• Page:
  IDS54-J. Prevent LDAP injection
• Page:
  IDS55-J. Understand how escape characters are interpreted when strings are loaded
• Page:
  IDS56-J. Prevent arbitrary file upload
• Page:
  MET50-J. Avoid ambiguous or confusing uses of overloading
• Page:
  MET51-J. Do not use overloaded methods to differentiate between runtime types
• Page:
  MET52-J. Do not use the clone() method to copy untrusted method parameters
• Page:
  MET53-J. Ensure that the clone() method calls super.clone()
• Page:
  MET54-J. Always provide feedback about the resulting value of a method
• Page:
  MET55-J. Return an empty array or collection instead of a null value for methods that return an array or collection
• Page:
  MET56-J. Do not use Object.equals() to compare cryptographic keys
• Page:
  MSC50-J. Minimize the scope of the @SuppressWarnings annotation
• Page:
  MSC51-J. Do not place a semicolon immediately following an if, for, or while condition
• Page:
  MSC52-J. Finish every set of statements associated with a case label with a break statement
• Page:
  MSC53-J. Carefully design interfaces before releasing them
• Page:
  MSC54-J. Avoid inadvertent wrapping of loop counters
• Page:
  MSC55-J. Use comments consistently and in a readable fashion
• Page:
  MSC56-J. Detect and remove superfluous code and values
• Page:
  MSC57-J. Strive for logical completeness
• Page:
  MSC58-J. Prefer using iterators over enumerations
• Page:
  MSC59-J. Limit the lifetime of sensitive data
• Page:
  MSC60-J. Do not use assertions to verify the absence of runtime errors
• Page:
  MSC61-J. Do not use insecure or weak cryptographic algorithms
• Page:
  MSC62-J. Store passwords using a hash function
• Page:
  MSC63-J. Ensure that SecureRandom is properly seeded
• Page:
  NUM50-J. Convert integers to floating point for floating-point operations
• Page:
  NUM51-J. Do not assume that the remainder operator always returns a nonnegative result for integral operands
• Page:
  NUM52-J. Be aware of numeric promotion behavior
• Page:
  NUM53-J. Use the strictfp modifier for floating-point calculation consistency across platforms
• Page:
  NUM54-J. Do not use denormalized numbers
• Page:
  OBJ50-J. Never confuse the immutability of a reference with that of the referenced object
• Page:
  OBJ51-J. Minimize the accessibility of classes and their members
• Page:
  OBJ52-J. Write garbage-collection-friendly code
• Page:
  OBJ53-J. Do not use direct buffers for short-lived, infrequently used objects
• Page:
  OBJ54-J. Do not attempt to help the garbage collector by setting local reference variables to null
• Page:
  OBJ55-J. Remove short-lived objects from long-lived container objects
• Page:
  OBJ56-J. Provide sensitive mutable classes with unmodifiable wrappers
• Page:
  OBJ57-J. Do not rely on methods that can be overridden by untrusted code
• Page:
  OBJ58-J. Limit the extensibility of classes and methods with invariants
• Page:
  Rec. AA. References
• Page:
  Rec. BB. Definitions
• Page:
  Rule or Rec. CC. Analyzers
• Page:
  Rule or Rec. DD. Related Guidelines
• Page:
  Rule or Rec. EE. Risk Assessments
• Page:
  SEC50-J. Avoid granting excess privileges
• Page:
  SEC51-J. Minimize privileged code
• Page:
  SEC52-J. Do not expose methods that use reduced-security checks to untrusted code
• Page:
  SEC53-J. Define custom security permissions for fine-grained security
• Page:
  SEC54-J. Create a secure sandbox using a security manager
• Page:
  SEC55-J. Ensure that security-sensitive methods are called with validated arguments
• Page:
  SEC56-J. Do not serialize direct handles to system resources
• Page:
  SEC57-J. Do not let untrusted code misuse privileges of callback methods
• Page:
  SEC58-J. Deserialization methods should not perform potentially dangerous operations
• Page:
  STR50-J. Use the appropriate method for counting characters in a string
• Page:
  STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required