Recommendations
FIO00-J. Reserved (moved to SER)
FIO01-J. Canonicalize path names originating from untrusted sources
FIO02-J. Use Runtime.exec() correctly
FIO03-J. Keep track of bytes read and account for character encoding while reading data
FIO05-J. Document character encoding while performing file or network IO
FIO06-J. Reserved (moved to FIO rules)
FIO07-J. Do not assume infinite heap space
Rules
FIO30-J. Do not log sensitive information
FIO31-J. Create a copy of mutable inputs
FIO32-J. Reserved (moved to SER)
FIO33-J. Reserved (moved to SER)
FIO34-J. Ensure all resources are properly closed when they are no longer needed
FIO35-J. Exclude user input from format strings
FIO36-J. Reserved (moved to MSC31-J)
FIO37-J. Create and delete temporary files safely
FIO39-J. Do not create multiple buffered wrappers on an InputStream
Risk Assessment Summary
Recommendations
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
FIO00-J |
TODO |
TODO |
TODO |
TODO |
TODO |
FIO01-J |
medium |
unlikely |
medium |
P4 |
L3 |
FIO02-J |
medium |
unlikely |
medium |
P4 |
L3 |
FIO03-J |
low |
unlikely |
medium |
P2 |
L3 |
FIO04-J |
TODO |
TODO |
TODO |
TODO |
TODO |
FIO05-J |
TODO |
TODO |
TODO |
TODO |
TODO |
FIO06-J |
TODO |
TODO |
TODO |
TODO |
TODO |
FIO07-J |
medium |
probable |
high |
P4 |
L3 |
Rules
Rules |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
FIO30-J |
TODO |
TODO |
TODO |
TODO |
TODO |
FIO31-J |
TODO |
TODO |
TODO |
TODO |
TODO |
FIO32-J |
TODO |
TODO |
TODO |
TODO |
TODO |
FIO33-J |
TODO |
TODO |
TODO |
TODO |
TODO |
FIO34-J |
low |
probable |
medium |
P4 |
L3 |
FIO35-J |
medium |
unlikely |
medium |
P4 |
L3 |
FIO36-J |
high |
probable |
medium |
P12 |
L1 |
FIO37-J |
medium |
probable |
high |
P4 |
L3 |
FIO38-J |
medium |
probable |
high |
P4 |
L3 |
FIO39-J |
low |
unlikely |
medium |
P2 |
L3 |
OBJ35-J. Use checked collections against external code The CERT Sun Microsystems Secure Coding Standard for Java SER31-J. Validate deserialized objects