{"platform":{"name":"Heimdall Tools","release":"1.3.0"},"version":"1.3.0","statistics":{"duration":null},"profiles":[{"name":"SonarQube Scan","version":"7.9.1.27448","title":"SonarQube Scan of Project: heimdall","maintainer":null,"summary":"SonarQube Scan of Project: heimdall","license":null,"copyright":null,"copyright_email":null,"supports":[],"attributes":[],"depends":[],"groups":[],"status":"loaded","controls":[{"title":"\"SecureRandom\" seeds should not be predictable","desc":"<p>The <code>java.security.SecureRandom</code> class provides a strong random number generator (RNG) appropriate for cryptography. However, seeding it\nwith a constant or another predictable value will weaken it significantly. In general, it is much safer to rely on the seed provided by the\n<code>SecureRandom</code> implementation.</p>\n<p>This rule raises an issue when <code>SecureRandom.setSeed()</code> or <code>SecureRandom(byte[])</code> are called with a seed that is either\nof:</p>\n<ul>\n  <li> a constant </li>\n  <li> <code>System.currentTimeMillis()</code> </li>\n</ul>\n<h2>Noncompliant Code Example</h2>\n<pre>\nSecureRandom sr = new SecureRandom();\nsr.setSeed(123456L); // Noncompliant\nint v = sr.next(32);\n\nsr = new SecureRandom(\"abcdefghijklmnop\".getBytes(\"us-ascii\")); // Noncompliant\nv = sr.next(32);\n</pre>\n<h2>Compliant Solution</h2>\n<pre>\nSecureRandom sr = new SecureRandom();\nint v = sr.next(32);\n</pre>\n<h2>See</h2>\n<ul>\n  <li> <a href=\"https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration\">OWASP Top 10 2017 Category A6</a> - Security\n  Misconfiguration </li>\n  <li> <a href=\"http://cwe.mitre.org/data/definitions/330.html\">MITRE, CWE-330</a> - Use of Insufficiently Random Values </li>\n  <li> <a href=\"http://cwe.mitre.org/data/definitions/332.html\">MITRE, CWE-332</a> - Insufficient Entropy in PRNG </li>\n  <li> <a href=\"http://cwe.mitre.org/data/definitions/336.html\">MITRE, CWE-336</a> - Same Seed in Pseudo-Random Number Generator (PRNG) </li>\n  <li> <a href=\"http://cwe.mitre.org/data/definitions/337.html\">MITRE, CWE-337</a> - Predictable Seed in Pseudo-Random Number Generator (PRNG) </li>\n  <li> <a href=\"https://wiki.sei.cmu.edu/confluence/display/java/MSC63-J.+Ensure+that+SecureRandom+is+properly+seeded\">CERT, MSC63J.</a> - Ensure that\n  SecureRandom is properly seeded </li>\n</ul>","impact":0.7,"tags":{"nist":["SC-13","Rev_4"]},"results":[{"status":"failed","code_desc":"Path:heimdall:src/Random.java:10:10 StartLine: 7, EndLine: 13<br>Code:<pre>  {\n    SecureRandom sr = new SecureRandom();\n    sr.setSeed(123456L); // Noncompliant\n    System.out.println(sr.nextInt(32));\n  }\n}</pre>","run_time":0.0,"start_time":"Thu,26 Sep 2019 10:56:37"}],"code":null,"id":"squid:S4347","descriptions":[],"refs":[],"source_location":{}},{"title":"Class variable fields should not have public accessibility","desc":"<p>Public class variable fields do not respect the encapsulation principle and has three main disadvantages:</p>\n<ul>\n  <li> Additional behavior such as validation cannot be added. </li>\n  <li> The internal representation is exposed, and cannot be changed afterwards. </li>\n  <li> Member values are subject to change from anywhere in the code and may not meet the programmer's assumptions. </li>\n</ul>\n<p>By using private attributes and accessor methods (set and get), unauthorized modifications are prevented.</p>\n<h2>Noncompliant Code Example</h2>\n<pre>\npublic class MyClass {\n\n  public static final int SOME_CONSTANT = 0;     // Compliant - constants are not checked\n\n  public String firstName;                       // Noncompliant\n\n}\n</pre>\n<h2>Compliant Solution</h2>\n<pre>\npublic class MyClass {\n\n  public static final int SOME_CONSTANT = 0;     // Compliant - constants are not checked\n\n  private String firstName;                      // Compliant\n\n  public String getFirstName() {\n    return firstName;\n  }\n\n  public void setFirstName(String firstName) {\n    this.firstName = firstName;\n  }\n\n}\n</pre>\n<h2>Exceptions</h2>\n<p>Because they are not modifiable, this rule ignores <code>public final</code> fields.</p>\n<h2>See</h2>\n<ul>\n  <li> <a href=\"http://cwe.mitre.org/data/definitions/493.html\">MITRE, CWE-493</a> - Critical Public Variable Without Final Modifier </li>\n</ul>","impact":0.3,"tags":{"nist":["SI-11","Rev_4"]},"results":[{"status":"failed","code_desc":"Path:heimdall:src/BadEnum.java:6:6 StartLine: 3, EndLine: 9<br>Code:<pre>  EUROPE (50, 39310000);\n\n  public int countryCount;  // Noncompliant\n  private int landMass;\n\n  Continent(int countryCount, int landMass) {\n    this.countryCount = countryCount;</pre>","run_time":0.0,"start_time":"Thu,26 Sep 2019 10:56:37"}],"code":null,"id":"squid:ClassVariableVisibilityCheck","descriptions":[],"refs":[],"source_location":{}},{"title":"\"enum\" fields should not be publicly mutable","desc":"<p><code>enum</code>s are generally thought of as constant, but an <code>enum</code> with a <code>public</code> field or <code>public</code> setter is\nnot only non-constant, but also vulnerable to malicious code. Ideally fields in an <code>enum</code> are <code>private</code> and set in the\nconstructor, but if that's not possible, their visibility should be reduced as much as possible.</p>\n<h2>Noncompliant Code Example</h2>\n<pre>\npublic enum Continent {\n\n  NORTH_AMERICA (23, 24709000),\n  // ...\n  EUROPE (50, 39310000);\n\n  public int countryCount;  // Noncompliant\n  private int landMass;\n\n  Continent(int countryCount, int landMass) {\n    // ...\n  }\n\n  public void setLandMass(int landMass) {  // Noncompliant\n    this.landMass = landMass;\n  }\n</pre>\n<h2>Compliant Solution</h2>\n<pre>\npublic enum Continent {\n\n  NORTH_AMERICA (23, 24709000),\n  // ...\n  EUROPE (50, 39310000);\n\n  private int countryCount;\n  private int landMass;\n\n  Continent(int countryCount, int landMass) {\n    // ...\n  }\n</pre>","impact":0.3,"tags":{"nist":["unmapped"]},"results":[{"status":"failed","code_desc":"Path:heimdall:src/BadEnum.java:6:6 StartLine: 3, EndLine: 9<br>Code:<pre>  EUROPE (50, 39310000);\n\n  public int countryCount;  // Noncompliant\n  private int landMass;\n\n  Continent(int countryCount, int landMass) {\n    this.countryCount = countryCount;</pre>","run_time":0.0,"start_time":"Thu,26 Sep 2019 10:56:37"}],"code":null,"id":"squid:S3066","descriptions":[],"refs":[],"source_location":{}}],"sha256":"6f94b370ebaa414fda5a2a80575cc772e3d0cc58ce04adc6d74a61a48080c886"}]}