Rules

Risk Assessment Summary

Rule

Severity

Likelihood

Detectable

Repairable

Priority

Level

MET00-JHighLikelyNoNo

P9

L2

MET01-JMediumProbableNoYes

P8

L2

MET02-JLowUnlikelyYesNo

P2

L3

MET03-JMediumProbableNoNo

P4

L3

MET04-JMediumProbableYesNo

P8

L2

MET05-JMediumProbableYesNo

P8

L2

MET06-JMediumProbableYesNo

P8

L2

MET07-JLowUnlikelyYesNo

P2

L3

MET08-JLowUnlikelyNoNo

P1

L3

MET09-JLowUnlikelyYesNo

P2

L3

MET10-JMediumUnlikelyNoNo

P2

L3

MET11-JLowProbableYesNo

P4

L3

MET12-JMediumProbableYesNo

P8

L2

MET13-JMediumLikelyNoNo

P6

L2



5 Comments

  1. Jonathan Paulson

    It might be worth adding [Rogue 2000] rule 80: Always construct objects in a valid state.

    1. David Svoboda

      Such a rule would belong in the OBJ section. The rule OBJ05-J. Do not allow access to partially initialized objects addresses the potential of constructing invalid 'zombie' objects, pointing out that it is harder to maintain a design that securely allows objects to be constructed in an invalid state.

  2. Yozo TODA

    the tinylink of this index page "https://www.securecoding.cert.org/confluence/x/toUbAQ" does not work...
    (Page Not Found)

    mis-configuration?

    1. David Svoboda

      It's working now.

  3. Jwalant

    My method argument are javabean. Not sure about how to validate javabean type argument. using fortify tool which complain about trusting non validated argument. I appreciate your response on jwalantonline .at gmail.