<p>1. Annotations</p>

<p>2. public</p>

<p>3. protected</p>

<p>4. private</p>

<p>5. abstract</p>

<p>6. static</p>

<p>7. final</p>

<p>8. transient</p>

<p>9. volatile</p>

<p>10. synchronized</p>

<p>11. native</p>

<p>12. strictfp</p>

<p> * listed multiple times</p>

<p> * a subclass of another listed exception</p>

<p> * completely unnecessary because the declared exception type cannot actually be thrown</p>

<p> * in overriding and implementation methods</p>

<p> * in interface <code>default</code> methods</p>

<p> * in non-private methods that only <code>throw</code>, have empty bodies, or a single return statement.</p>

<p> * in overridable methods (non-final, or not member of a final class, non-static, non-private), if the exception is documented with a proper

JavaDoc</p>

<li> <code>x.clone().equals\(x\)</code> </li>

<p> * <a href="https://wiki.sei.cmu.edu/confluence/x/1zdGBQ">CERT, LCK01-J.</a> - Do not synchronize on objects that may be reused</p>

<p> * <a href="https://openjdk.java.net/jeps/390">JEP-390.</a> - JEP 390: Warnings for Value-Based Classes</p>

<p>Formatting strings used as SQL queries is security-sensitive. It has led in the past to the following vulnerabilities:</p>

<li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9019">CVE-2018-9019</a> </li>

<li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7318">CVE-2018-7318</a> </li>

<li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5611">CVE-2017-5611</a> </li>

<p>SQL queries often need to use a hardcoded SQL string with a dynamic parameter coming from a user request. Formatting a string to add those

parameters to the request is a bad practice as it can result in an <a href="https://www.owasp.org/index.php/SQL_Injection">SQL injection</a>. The safe

way to add parameters to a SQL query is to use SQL binding mechanisms.</p>

<p>This rule raises an issue when an SQL query is built by formatting Strings, even if there is no injection. This rule does not detect SQL

injections. The goal is to guide security code reviews and to prevent a common bad practice.</p>

<p>The following method signatures from Java JDBC, JPA, JDO, Hibernate and Spring are tested: </p>

<li> <code>org.hibernate.Session.createQuery</code> </li>

<li> <code>org.hibernate.Session.createSQLQuery</code> </li>

<li> <code>java.sql.Statement.executeQuery</code> </li>

<li> <code>java.sql.Statement.execute</code> </li>

<li> <code>java.sql.Statement.executeUpdate</code> </li>

<li> <code>java.sql.Statement.executeLargeUpdate</code> </li>

<li> <code>java.sql.Statement.addBatch</code> </li>

<li> <code>java.sql.Connection.prepareStatement</code> </li>

<li> <code>java.sql.Connection.prepareCall</code> </li>

<li> <code>java.sql.Connection.nativeSQL</code> </li>

<li> <code>javax.persistence.EntityManager.createNativeQuery</code> </li>

<li> <code>javax.persistence.EntityManager.createQuery</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.batchUpdate</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.execute</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.query</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.queryForList</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.queryForMap</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.queryForObject</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.queryForRowSet</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.queryForInt</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.queryForLong</code> </li>

<li> <code>org.springframework.jdbc.core.JdbcOperations.update</code> </li>

<li> <code>org.springframework.jdbc.core.PreparedStatementCreatorFactory.&lt;init&gt;</code> </li>

<li> <code>org.springframework.jdbc.core.PreparedStatementCreatorFactory.newPreparedStatementCreator</code> </li>

<li> <code>javax.jdo.PersistenceManager.newQuery</code> </li>

<li> <code>javax.jdo.Query.setFilter</code> </li>

<li> <code>javax.jdo.Query.setGrouping</code> </li>

<p>If a method is defined in an interface, implementations are also tested. For example this is the case for

<code>org.springframework.jdbc.core.JdbcOperations</code> , which is usually used as <code>org.springframework.jdbc.core.JdbcTemplate</code>). </p>

<li> the SQL query is built using string formatting technics, such as concatenating variables. </li>

<li> some of the values are coming from an untrusted source and are not sanitized. </li>

<li> Avoid building queries manually using formatting technics. If you do it anyway, do not include user input in this building process. </li>

procedures</a> whenever possible. </li>

<li> You may also use ORM frameworks such as Hibernate which, if used correctly, reduce injection risks. </li>

<li> Avoid executing SQL queries containing unsafe input in stored procedures or functions. </li>

<li> <a href="https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet">Sanitize</a> every unsafe input. </li>

<p>You can also reduce the impact of an attack by using a database account with low privileges.</p>

"defaultSeverity": "Critical",

<p>Databases should always be password protected. The use of a database connection with an empty password is a clear indication of a database that is

not protected.</p>

<p>This rule flags database connections with empty passwords.</p>

Connection conn = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "AppLogin", "");

Connection conn2 = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true?user=user&amp;password=");

DriverManager.getConnection("jdbc:derby:memory:myDB;create=true?user=user&amp;password=password");

DriverManager.getConnection("jdbc:mysql://address=(host=myhost1)(port=1111)(key1=value1)(user=sandy)(password=secret),address=(host=myhost2)(port=2222)(key2=value2)(user=sandy)(password=secret)/db");

DriverManager.getConnection("jdbc:mysql://sandy:secret@[myhost1:1111,myhost2:2222]/db");

String url = "jdbc:postgresql://localhost/test";

Properties props = new Properties();

props.setProperty("user", "fred");

props.setProperty("password", "secret");

DriverManager.getConnection(url, props);