Skip to content

Commit 90f00f9

Browse files
ddsharpeddsharpe
committed
Fortify filter
1 parent 085c184 commit 90f00f9

File tree

1 file changed

+270
-0
lines changed

1 file changed

+270
-0
lines changed

‎build-tools/src/main/resources/fortify/Filter_SecComply.txt

Lines changed: 270 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,270 @@
1+
Code Correctness: Arithmetic Operation on Boolean
2+
Code Correctness: Function Not Invoked
3+
Code Correctness: Function Returns Stack Address
4+
Code Correctness: Macro Misuse
5+
Code Correctness: Memory Free on Stack Variable
6+
Code Correctness: Premature Thread Termination
7+
Dead Code
8+
Double Free
9+
Format String: Argument Number Mismatch
10+
Format String: Argument Type Mismatch
11+
Memory Leak
12+
Memory Leak: Reallocation
13+
Null Dereference
14+
Obsolete
15+
Obsolete: Inadequate Pointer Validation
16+
Poor Style: Redundant Initialization
17+
Poor Style: Value Never Read
18+
Poor Style: Variable Never Used
19+
Portability Flaw
20+
Redundant Null Check
21+
Type Mismatch: Integer to Character
22+
Type Mismatch: Negative to Unsigned
23+
Type Mismatch: Signed to Unsigned
24+
Undefined Behavior
25+
Undefined Behavior: Redundant Delete
26+
Uninitialized Variable
27+
Use After Free
28+
Missing Check against Null
29+
Often Misused: Authentication(gethostby)
30+
Often Misused: Authentication(getlogin)
31+
Often Misused: Exception Handling(_alloca)
32+
Often Misused: Exception Handling(criticalsection)
33+
Often Misused: File System(getwd)
34+
Often Misused: File System(readlink)
35+
Often Misused: File System(realpath)
36+
Often Misused: File System(umask)
37+
Often Misused: File System(windows)
38+
Often Misused: Privilege Management
39+
Often Misused: Privilege Management(setuid)
40+
Often Misused: Strings(_mbs)
41+
Often Misused: Strings(multibytewidechar)
42+
Unchecked Return Value
43+
System Information Leak
44+
Insecure Compiler Optimization
45+
Insecure Compiler Optimization: Pointer Arithmetic
46+
Code Correctness: Erroneous Synchronization
47+
Insecure Temporary File
48+
Race Condition: File System Access
49+
Race Condition: Signal Handling
50+
ADF Faces Bad Practices: unsecure Attribute
51+
Castor Bad Practices: Query Mode Not Read-Only
52+
Castor Bad Practices: Unspecified Query Mode
53+
Code Correctness: Call to System.gc()
54+
Code Correctness: Class Does Not Implement equals
55+
Code Correctness: Erroneous finalize() Method
56+
Code Correctness: toString on Array
57+
Dangerous Field
58+
Dangerous Method
59+
Dangerous Type
60+
EJB Bad Practices: Use of AWT/Swing
61+
EJB Bad Practices: Use of Class Loader
62+
EJB Bad Practices: Use of Sockets
63+
EJB Bad Practices: Use of Synchronization Primitives
64+
EJB Bad Practices: Use of java.io
65+
Immutable Classes: Field Mutation
66+
Immutable Classes: Non-final Fields
67+
Immutable Classes: Public Mutable Fields
68+
J2EE Bad Practices: Sockets
69+
J2EE Bad Practices: getConnection()
70+
Missing Check against Null
71+
Missing Check for Null Parameter
72+
Object Model Violation: Erroneous clone() Method
73+
Object Model Violation: Just one of equals() and hashCode() Defined
74+
Object Model Violation: Just one of restoreState() and saveState() Defined
75+
Obsolete: Deprecated by ESAPI
76+
Often Misused: Authentication
77+
Often Misused: Encoding
78+
Password Management: Weak Redundancy
79+
Poor Style: Explicit Call to finalize()
80+
Unchecked Return Value
81+
Code Correctness: Call to Thread.run()
82+
Code Correctness: Call to notify()
83+
Code Correctness: Class Does Not Implement Cloneable
84+
Code Correctness: Erroneous Class Compare
85+
Code Correctness: Erroneous Negative Value
86+
Code Correctness: Erroneous String Compare
87+
Code Correctness: Erroneous Zero Value
88+
Code Correctness: Incorrect serialPersistentFields Modifier
89+
Code Correctness: Misspelled Method Name
90+
Code Correctness: Non-Synchronized Method Overrides Synchronized Method
91+
Code Correctness: null Argument to equals()
92+
Dead Code: Empty Try Block
93+
Dead Code: Expression is Always false
94+
Dead Code: Expression is Always true
95+
Dead Code: Unused Field
96+
Dead Code: Unused Method
97+
Null Dereference
98+
Obsolete
99+
Poor Style: Confusing Naming(class_and_member)
100+
Poor Style: Confusing Naming(member_and_method)
101+
Poor Style: Empty Synchronized Block
102+
Poor Style: Identifier Contains Dollar Symbol ($)
103+
Poor Style: Redundant Initialization
104+
Poor Style: Value Never Read
105+
Redundant Null Check
106+
Unreleased Resource: Synchronization
107+
ADF Bad Practices: Default url-invoke-disallowed Setting
108+
Cross-Site Request Forgery
109+
Hidden Field
110+
Insecure Storage: Android External Storage
111+
J2EE Bad Practices: Leftover Debug Code
112+
JavaScript Hijacking: Ad Hoc Ajax
113+
JavaScript Hijacking: Vulnerable Framework
114+
Poor Logging Practice: Logger Not Declared Static Final
115+
Poor Logging Practice: Multiple Loggers
116+
Poor Logging Practice: Use of a System Output Stream
117+
Poor Style: Non-final Public Static Field
118+
System Information Leak
119+
System Information Leak: Apache Axis
120+
System Information Leak: Apache Axis 2
121+
System Information Leak: HTML Comment in JSP
122+
System Information Leak: Incomplete Servlet Error Handling
123+
System Information Leak: Overly Broad SQL Logging
124+
Trust Boundary Violation
125+
Unsafe Mobile Code: Access Violation
126+
Unsafe Mobile Code: Database Access
127+
Unsafe Mobile Code: Inner Class
128+
Unsafe Mobile Code: Public finalize() Method
129+
Unsafe Mobile Code: Unsafe Array Declaration
130+
Unsafe Mobile Code: Unsafe Public Field
131+
Axis 2 Misconfiguration: Debug Information
132+
Axis 2 Misconfiguration: Insecure Message Security
133+
Axis 2 Misconfiguration: Insecure Transport Receiver
134+
Axis 2 Misconfiguration: Insecure Transport Sender
135+
Axis 2 Service Provider Misconfiguration: Inbound WS-Security Not Enabled
136+
Axis 2 Service Provider Misconfiguration: Missing Inbound Encryption
137+
Axis 2 Service Provider Misconfiguration: Missing Inbound Signature
138+
Axis 2 Service Provider Misconfiguration: Missing Inbound Timestamp
139+
Axis 2 Service Provider Misconfiguration: Missing Outbound Encryption
140+
Axis 2 Service Provider Misconfiguration: Missing Outbound Signature
141+
Axis 2 Service Provider Misconfiguration: Missing Outbound Timestamp
142+
Axis 2 Service Provider Misconfiguration: Outbound WS-Security Not Enabled
143+
Axis 2 Service Provider Misconfiguration: Unsigned Inbound Timestamp
144+
Axis 2 Service Provider Misconfiguration: Unsigned Outbound Timestamp
145+
Axis 2 Service Provider Misconfiguration: WS-Security Not Enabled
146+
Axis 2 Service Provider Misconfiguration: Weak Token
147+
Axis 2 Service Requester Misconfiguration: Inbound WS-Security Not Enabled
148+
Axis 2 Service Requester Misconfiguration: Missing Inbound Encryption
149+
Axis 2 Service Requester Misconfiguration: Missing Inbound Signature
150+
Axis 2 Service Requester Misconfiguration: Missing Inbound Timestamp
151+
Axis 2 Service Requester Misconfiguration: Missing Outbound Encryption
152+
Axis 2 Service Requester Misconfiguration: Missing Outbound Signature
153+
Axis 2 Service Requester Misconfiguration: Missing Outbound Timestamp
154+
Axis 2 Service Requester Misconfiguration: Outbound WS-Security Not Enabled
155+
Axis 2 Service Requester Misconfiguration: Plain Text Password
156+
Axis 2 Service Requester Misconfiguration: Unsigned Inbound Timestamp
157+
Axis 2 Service Requester Misconfiguration: Unsigned Outbound Timestamp
158+
Axis 2 Service Requester Misconfiguration: WS-Security Not Enabled
159+
Axis 2 Service Requester Misconfiguration: Weak Token
160+
Axis Misconfiguration: Debug Information
161+
Axis Misconfiguration: Service Enumeration
162+
Axis Service Provider Misconfiguration: Plain Text Password
163+
Axis Service Provider Misconfiguration: Weak Token
164+
Axis Service Requester Misconfiguration: Plain Text Password
165+
Axis Service Requester Misconfiguration: Weak Token
166+
Build Misconfiguration: Dynamic Dependency Version Usage
167+
Build Misconfiguration: External Ant Dependency Repository
168+
Build Misconfiguration: External Ivy Dependency Repository
169+
Build Misconfiguration: External Maven Dependency Repository
170+
Flex Misconfiguration: Debug Information
171+
J2EE Misconfiguration: Cookies Disabled
172+
J2EE Misconfiguration: Debug Information
173+
J2EE Misconfiguration: Direct JSP Access
174+
J2EE Misconfiguration: Duplicate Security Role
175+
J2EE Misconfiguration: Duplicate Servlet Mapping
176+
J2EE Misconfiguration: Excessive Servlet Mappings
177+
J2EE Misconfiguration: Excessive Session Timeout
178+
J2EE Misconfiguration: Incomplete Error Handling - (404)
179+
J2EE Misconfiguration: Incomplete Error Handling - (500)
180+
J2EE Misconfiguration: Incomplete Error Handling - (throwable)
181+
J2EE Misconfiguration: Insecure Transport
182+
J2EE Misconfiguration: Insufficient Session-ID Length
183+
J2EE Misconfiguration: Invalid Servlet Name
184+
J2EE Misconfiguration: Missing Authentication Method
185+
J2EE Misconfiguration: Missing Data Transport Constraint
186+
J2EE Misconfiguration: Missing Error Handling
187+
J2EE Misconfiguration: Missing Filter Definition
188+
J2EE Misconfiguration: Missing Security Role
189+
J2EE Misconfiguration: Missing Servlet Mapping
190+
J2EE Misconfiguration: Unsafe Bean Declaration
191+
J2EE Misconfiguration: Weak Access Permissions
192+
Password Management: Empty Password in Configuration File
193+
Password Management: Password in Configuration File
194+
Struts Misconfiguration: Duplicate Form Bean
195+
Struts Misconfiguration: Invalid Path
196+
Struts Misconfiguration: Missing Action Input
197+
Struts Misconfiguration: Missing Exception Type
198+
Struts Misconfiguration: Missing Form Bean
199+
Struts Misconfiguration: Missing Form Bean Name
200+
Struts Misconfiguration: Missing Form Bean Type
201+
Struts Misconfiguration: Missing Form Property Type
202+
Struts Misconfiguration: Missing Forward Name
203+
Struts Misconfiguration: Missing Forward Path
204+
Tomcat Configuration: Insecure Transport
205+
WebSphere Misconfiguration: Missing Nonce
206+
WebSphere Misconfiguration: Servlets Served By Class Name
207+
WebSphere Service Provider Misconfiguration: Inbound WS-Security Not Enabled
208+
WebSphere Service Provider Misconfiguration: Missing Inbound Encryption
209+
WebSphere Service Provider Misconfiguration: Missing Inbound Signature
210+
WebSphere Service Provider Misconfiguration: Missing Inbound Timestamp
211+
WebSphere Service Provider Misconfiguration: Missing Outbound Encryption
212+
WebSphere Service Provider Misconfiguration: Missing Outbound Signature
213+
WebSphere Service Provider Misconfiguration: Missing Outbound Timestamp
214+
WebSphere Service Provider Misconfiguration: Missing Timestamp Expiration
215+
WebSphere Service Provider Misconfiguration: Outbound WS-Security Not Enabled
216+
WebSphere Service Provider Misconfiguration: Unsigned Inbound Timestamp
217+
WebSphere Service Provider Misconfiguration: Unsigned Outbound Timestamp
218+
WebSphere Service Provider Misconfiguration: Weak Token
219+
WebSphere Service Requester Misconfiguration: Inbound WS-Security Not Enabled
220+
WebSphere Service Requester Misconfiguration: Missing Inbound Encryption
221+
WebSphere Service Requester Misconfiguration: Missing Inbound Signature
222+
WebSphere Service Requester Misconfiguration: Missing Inbound Timestamp
223+
WebSphere Service Requester Misconfiguration: Missing Outbound Encryption
224+
WebSphere Service Requester Misconfiguration: Missing Outbound Signature
225+
WebSphere Service Requester Misconfiguration: Missing Outbound Timestamp
226+
WebSphere Service Requester Misconfiguration: Missing Timestamp Expiration
227+
WebSphere Service Requester Misconfiguration: Outbound WS-Security Not Enabled
228+
WebSphere Service Requester Misconfiguration: Unsigned Inbound Timestamp
229+
WebSphere Service Requester Misconfiguration: Unsigned Outbound Timestamp
230+
WebSphere Service Requester Misconfiguration: Weak Token
231+
Weblogic Misconfiguration: Missing Timestamp
232+
Weblogic Misconfiguration: Weak Token
233+
Poor Error Handling: Empty Catch Block
234+
Poor Error Handling: Overly Broad Catch
235+
Poor Error Handling: Overly Broad Throws
236+
Poor Error Handling: Program Catches NullPointerException
237+
Poor Error Handling: Return Inside Finally
238+
Poor Error Handling: Swallowed ThreadDeath
239+
Poor Error Handling: Throw Inside Finally
240+
Poor Error Handling: Unhandled SSL Exception
241+
Weak SecurityManager Check: Overridable Method
242+
Privacy Violation
243+
Privilege Management: Amazon Web Services Unchecked Permissions
244+
Privilege Management: Android Data Storage
245+
Privilege Management: Android Disable
246+
Privilege Management: Android Location
247+
Privilege Management: Android Messaging
248+
Privilege Management: Android Network
249+
Privilege Management: Android Telephony
250+
Privilege Management: Overly Broad Access Specifier
251+
Missing SecurityManager Check: Cloneable
252+
Missing SecurityManager Check: Serializable
253+
Access Control: Amazon Web Services
254+
Access Control: Android ContentResolver
255+
Access Control: Anonymous LDAP Bind
256+
Access Control: Database
257+
Access Control: LDAP
258+
Access Control: Weak Security Constraint
259+
Acegi Misconfiguration: Insecure Channel Mixing
260+
Acegi Misconfiguration: Run-As Authentication Replacement
261+
Code Correctness: Call to sleep() in Lock
262+
Code Correctness: Double-Checked Locking
263+
J2EE Bad Practices: Non-Serializable Object Stored in Session
264+
J2EE Bad Practices: System.exit
265+
J2EE Bad Practices: Threads
266+
Race Condition: Format Flaw
267+
Code Correctness: Multiple Stream Commits
268+
Denial of Service: Parse Double
269+
File Disclosure: J2EE
270+
Poor Style: Confusing Naming

0 commit comments

Comments
 (0)