SonarQube 代码规则之漏洞

1、"@RequestMapping" methods should be “public”
2、"@RequestMapping" methods should specify HTTP method
3、“enum” fields should not be publicly mutable
4、“File.createTempFile” should not be used to create a directory
5、“File.createTempFile” should not be used to create a directory
6、“HostnameVerifier.verify” should not always return true
7、“HttpOnly” should be set on cookies
8、“HttpSecurity” URL patterns should be correctly ordered
9、“HttpServletRequest.getRequestedSessionId()” should not be used
10、“javax.crypto.NullCipher” should not be used for anything other than testing
11、“public static” fields should be constant
12、“SecureRandom” seeds should not be predictable
13、AES encryption algorithm should be used with secured mode
14、Basic authentication should not be used
15、Class variable fields should not have public accessibility
16、Classes should not be loaded dynamically
17、Credentials should not be hard-coded
18、Cryptographic keys should not be too short
19、Cryptographic RSA algorithms should always incorporate OAEP (Optimal Asymmetric Encryption Padding)
20、Cypher Block Chaining IV’s should be random and unique
21、Databases should be password-protected
22、Default EJB interceptors should be declared in “ejb-jar.xml”
23、Defined filters should be used
24、Exceptions should not be thrown from servlet methods
25、HTTP referers should not be relied on
26、LDAP connections should be authenticated
27、LDAP deserialization should be disabled
28、Member variable visibility should be specified
29、Members of Spring components should be injected
30、Mutable fields should not be “public static”
31、Mutable members should not be stored or returned directly
32、Neither DES (Data Encryption Standard) nor DESede (3DES) should be used
33、Persistent entities should not be used as arguments of “@RequestMapping” methods
34、Return values should not be ignored when they contain the operation status code
35、Security constraints should be defined
36、SMTP SSL connection should check server identity
37、Struts validation forms should have unique names
38、Throwable.printStackTrace(…) should not be called
39、TrustManagers should not blindly accept any certificates
40、Untrusted XML should be parsed with a local, static DTD
41、Weak SSL protocols should not be used
42、Web applications should not have a “main” method
43、XML transformers should be secured
摘自：sonarqube