Java

In this section, you will find a list of the rules associated with the Java language and the security requirements.

Method	Security Requirement
JAVA_ACCEPTS_ANY_MIMETYPE_CHAIN	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_BASIC_AUTHENTICATION	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
JAVA_CREATE_TEMP_FILE	095. Define users with privileges 096. Set user's required privileges 186. Use the principle of least privilege
JAVA_CSRF_PROTECTIONS_DISABLED	029. Cookies with security attributes 174. Transactions without a distinguishable pattern
JAVA_HOSTNAME_VERIFICATION_OFF	088. Request client certificates 089. Limit validity of certificates 090. Use valid certificates 091. Use internally signed certificates 092. Use externally signed certificates 093. Use consistent certificates
JAVA_HOST_KEY_CHECKING	255. Allow access only to the necessary ports
JAVA_HTTP_ONLY_COOKIE	029. Cookies with security attributes
JAVA_HTTP_REQ_ACCEPTS_ANY_MIMETYPE	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_INSECURE_AUTHENTICATION	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
JAVA_INSECURE_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CIPHER_JMQI	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CIPHER_MODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CIPHER_SSL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CONNECTION	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_CORS_ORIGIN	062. Define standard configurations 266. Disable insecure functionalities 349. Include HTTP security headers
JAVA_INSECURE_HASH	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_KEY	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_KEY_EC	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_KEY_RSA	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_KEY_SECRET	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_LOGGING	080. Prevent log modification 173. Discard unsafe inputs
JAVA_INSECURE_PASS	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_INSECURE_TRUST_MANAGER	088. Request client certificates 089. Limit validity of certificates 090. Use valid certificates 091. Use internally signed certificates 092. Use externally signed certificates 093. Use consistent certificates
JAVA_INSEC_SIGN_ALGORITHM	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_JPA_LIKE	169. Use parameterized queries 173. Discard unsafe inputs
JAVA_JWT_UNSAFE_DECODE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_JWT_WITHOUT_PROPER_SIGN	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_LDAP_INJECTION	173. Discard unsafe inputs
JAVA_PROP_MISSING_SSL	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_PROP_SENSITIVE	145. Protect system cryptographic keys 156. Source code without sensitive information 266. Disable insecure functionalities
JAVA_PROP_UNENCRYPTED_TRANSPORT	181. Transmit data using secure protocols
JAVA_PROP_WEAK_CIPHER	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
JAVA_REMOTE_COMMAND_EXECUTION	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
JAVA_SALT_IS_HARDCODED	266. Disable insecure functionalities
AVA_SECURE_COOKIE	029. Cookies with security attributes
JAVA_SQL_INJECTION	169. Use parameterized queries 173. Discard unsafe inputs
JAVA_TRUST_BOUNDARY_VIOLATION	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
JAVA_UNSAFE_PATH_TRAVERSAL	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
JAVA_UNSAFE_XSS_CONTENT	029. Cookies with security attributes 173. Discard unsafe inputs
JAVA_UPLOAD_SIZE_LIMIT	040. Compare file format and extension 041. Scan files for malicious code
JAVA_USES_SYSTEM_EXIT	164. Use optimized structures 167. Close unused resources 072. Set maximum response time 327. Set a rate limit
JAVA_VULN_REGEX	072. Set maximum response time 327. Set a rate limit
JAVA_WEAK_RANDOM_COOKIE	223. Uniform distribution in random numbers 224. Use secure cryptographic mechanisms
JAVA_XML_PARSER	173. Discard unsafe inputs
JAVA_XPATH_INJECTION_EVALUATE	173. Discard unsafe inputs
JAVA_ZIP_SLIP_PATH_INJECTION	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters