SpotBugs Bug Detector Report
The following document contains the results of SpotBugs
SpotBugs Version is 4.10.3
Threshold is medium
Effort is default
Summary
| Classes | Bugs | Errors | Missing Classes |
|---|---|---|---|
| 310 | 117 | 0 | 0 |
Files
org.owasp.dependencycheck.analyzer.ArchiveAnalyzer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Shared primitive variable "maxScanDepth" in one thread may not yield the value of the most recent write from another thread | MT_CORRECTNESS | AT_STALE_THREAD_WRITE_OF_PRIMITIVE | 759 | Medium |
org.owasp.dependencycheck.analyzer.CentralAnalyzer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Static field "numberOfRetries" is modified by an instance level synchronized method. | MT_CORRECTNESS | SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA | 120 | Medium |
org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Do not catch NullPointerException like in org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.npmVersionsMatch(String, String) | STYLE | DCN_NULLPOINTER_EXCEPTION | 655 | Medium |
org.owasp.dependencycheck.analyzer.GolangModAnalyzer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Static field "goPath" is modified by an instance level synchronization lock. | MT_CORRECTNESS | SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA | 135 | Medium |
| Suppressing annotation SF_SWITCH_NO_DEFAULT on the method org.owasp.dependencycheck.analyzer.GolangModAnalyzer.prepareFileTypeAnalyzer(Engine) is unnecessary | STYLE | US_USELESS_SUPPRESSION_ON_METHOD | 220-269 | Medium |
org.owasp.dependencycheck.analyzer.JarAnalyzer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Suppressing annotation OBL_UNSATISFIED_OBLIGATION on the method org.owasp.dependencycheck.analyzer.JarAnalyzer.isZipFile(Dependency) is unnecessary | STYLE | US_USELESS_SUPPRESSION_ON_METHOD | 401-413 | Medium |
org.owasp.dependencycheck.analyzer.MSBuildProjectAnalyzer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Return value of org.apache.commons.io.input.BOMInputStream.getBOM() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 155 | Medium |
| Return value of org.apache.commons.io.input.BOMInputStream.getBOM() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 352 | Medium |
| Return value of org.apache.commons.io.input.BOMInputStream.getBOM() ignored, but method has no side effect | STYLE | RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT | 323 | Medium |
org.owasp.dependencycheck.analyzer.UnusedSuppressionRuleAnalyzer
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Operation on the "unusedSuppressionRuleCount" shared variable in "UnusedSuppressionRuleAnalyzer" class is not atomic | MT_CORRECTNESS | AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE | 129 | Medium |
org.owasp.dependencycheck.data.cache.DataCacheFactory
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.owasp.dependencycheck.data.cache.DataCacheFactory at new org.owasp.dependencycheck.data.cache.DataCacheFactory(Settings) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 101 | Medium |
org.owasp.dependencycheck.data.central.CentralSearch
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.owasp.dependencycheck.data.central.CentralSearch at new org.owasp.dependencycheck.data.central.CentralSearch(Settings) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 97 | Medium |
org.owasp.dependencycheck.data.cwe.CweDB
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Static synchronized method org.owasp.dependencycheck.data.cwe.CweDB.getFullName(String) uses intrinsic lock of class org.owasp.dependencycheck.data.cwe.CweDB for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 97-101 | Medium |
| Static synchronized method org.owasp.dependencycheck.data.cwe.CweDB.getName(String) uses intrinsic lock of class org.owasp.dependencycheck.data.cwe.CweDB for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 83-86 | Medium |
org.owasp.dependencycheck.data.knownexploited.json.Vulnerability
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Comparison of String objects using == or != in org.owasp.dependencycheck.data.knownexploited.json.Vulnerability.equals(Object) | BAD_PRACTICE | ES_COMPARING_STRINGS_WITH_EQ | 367 | Medium |
| Comparison of String objects using == or != in org.owasp.dependencycheck.data.knownexploited.json.Vulnerability.equals(Object) | BAD_PRACTICE | ES_COMPARING_STRINGS_WITH_EQ | 367 | Medium |
| Comparison of String objects using == or != in org.owasp.dependencycheck.data.knownexploited.json.Vulnerability.equals(Object) | BAD_PRACTICE | ES_COMPARING_STRINGS_WITH_EQ | 367 | Medium |
| Comparison of String objects using == or != in org.owasp.dependencycheck.data.knownexploited.json.Vulnerability.equals(Object) | BAD_PRACTICE | ES_COMPARING_STRINGS_WITH_EQ | 367 | Medium |
| Comparison of String objects using == or != in org.owasp.dependencycheck.data.knownexploited.json.Vulnerability.equals(Object) | BAD_PRACTICE | ES_COMPARING_STRINGS_WITH_EQ | 367 | Medium |
| Comparison of String objects using == or != in org.owasp.dependencycheck.data.knownexploited.json.Vulnerability.equals(Object) | BAD_PRACTICE | ES_COMPARING_STRINGS_WITH_EQ | 367 | Medium |
| Comparison of String objects using == or != in org.owasp.dependencycheck.data.knownexploited.json.Vulnerability.equals(Object) | BAD_PRACTICE | ES_COMPARING_STRINGS_WITH_EQ | 367 | Medium |
| Comparison of String objects using == or != in org.owasp.dependencycheck.data.knownexploited.json.Vulnerability.equals(Object) | BAD_PRACTICE | ES_COMPARING_STRINGS_WITH_EQ | 367 | Medium |
org.owasp.dependencycheck.data.nvd.ecosystem.CveEcosystemMapper
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvd.ecosystem.CveEcosystemMapper.hasMultipleVendorProductConfigurations(DefCveItem) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 85 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvd.ecosystem.CveEcosystemMapper.hasMultipleVendorProductConfigurations(DefCveItem) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 86 | Medium |
org.owasp.dependencycheck.data.nvdcve.CveDB
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.parseCpes(DefCveItem) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1623 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1205 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1206 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1254 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1255 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1258 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1259 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1299 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1300 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1206 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1255 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1259 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1300 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability(DefCveItem, String) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1098 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerabilityInsertCwe(int, DefCveItem) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1424 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerabilityInsertReferences(int, DefCveItem) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1594 | Medium |
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerabilityInsertReferences(int, DefCveItem) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 1582 | Medium |
org.owasp.dependencycheck.data.nvdcve.CveItemOperator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Possible null pointer dereference in org.owasp.dependencycheck.data.nvdcve.CveItemOperator.testCveCpeStartWithFilter(DefCveItem) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 224 | Medium |
org.owasp.dependencycheck.data.update.NvdApiDataSource
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception is caught when Exception is not thrown in org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi() | STYLE | REC_CATCH_EXCEPTION | 372 | Medium |
org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Static synchronized method org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache.getChanged() uses intrinsic lock of class org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 105 | Medium |
| Static synchronized method org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache.getEcosystem(String, String, String) uses intrinsic lock of class org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 68-85 | Medium |
| Static synchronized method org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache.isEmpty() uses intrinsic lock of class org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 116 | Medium |
| Static synchronized method org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache.setCache(Map) uses intrinsic lock of class org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache for synchronization, exposing the class to untrusted code. | SECURITY | USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION | 95-97 | Medium |
org.owasp.dependencycheck.data.update.nvd.api.CveApiJson20CveItemSource
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.owasp.dependencycheck.data.update.nvd.api.CveApiJson20CveItemSource at new org.owasp.dependencycheck.data.update.nvd.api.CveApiJson20CveItemSource(InputStream) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 64 | Medium |
org.owasp.dependencycheck.data.update.nvd.api.JsonArrayCveItemSource
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.owasp.dependencycheck.data.update.nvd.api.JsonArrayCveItemSource at new org.owasp.dependencycheck.data.update.nvd.api.JsonArrayCveItemSource(InputStream) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 63 | Medium |
org.owasp.dependencycheck.dependency.Dependency
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.owasp.dependencycheck.dependency.Dependency at new org.owasp.dependencycheck.dependency.Dependency(File) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 195 | Medium |
| Exception thrown in class org.owasp.dependencycheck.dependency.Dependency at new org.owasp.dependencycheck.dependency.Dependency(File, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 213 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addAllIncludedBy(Set) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 842-843 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addAllProjectReferences(Set) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 878-879 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addAvailableVersion(String) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 929-930 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addIncludedBy(String) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 822-823 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addIncludedBy(String, String) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 833-834 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addProjectReference(String) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 869-870 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addRelatedDependency(Dependency) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 888-903 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addSoftwareIdentifier(Identifier) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 497-518 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addSuppressedIdentifier(Identifier) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 606-607 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addSuppressedVulnerabilities(List) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 1026-1027 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addSuppressedVulnerability(Vulnerability) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 674-675 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addVulnerabilities(List) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 765-766 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addVulnerability(Vulnerability) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 756-757 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.addVulnerableSoftwareIdentifier(Identifier) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 527-528 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.clearRelatedDependencies() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 792-793 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getAvailableVersions() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 920 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getIncludedBy() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 802 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getIncludedBySorted() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 812 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getProjectReferences() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 851 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getProjectReferencesSorted() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 860 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 785 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getSoftwareIdentifiers() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 433 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getSuppressedIdentifiers() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 597 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getSuppressedVulnerabilities() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 649 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getSuppressedVulnerabilities(boolean) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 660-665 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getVulnerabilities() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 615 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getVulnerabilities(boolean) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 626-631 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getVulnerabilitiesCount() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 640 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getVulnerableSoftwareIdentifiers() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 442 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.getVulnerableSoftwareIdentifiersCount() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 451 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.hasKnownExploitedVulnerability() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 461-466 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.removeRelatedDependencies(Dependency) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 911-912 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.removeVulnerability(Vulnerability) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 774-775 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.removeVulnerableSoftwareIdentifier(Identifier) uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 536-537 | Medium |
| Method org.owasp.dependencycheck.dependency.Dependency.toString() uses intrinsic lock of class org.owasp.dependencycheck.dependency.Dependency for synchronization, that is exposed by org.owasp.dependencycheck.dependency.Dependency.getRelatedDependencies()Ljava/util/Set;. | SECURITY | USO_UNSAFE_METHOD_SYNCHRONIZATION | 1016 | Medium |
org.owasp.dependencycheck.dependency.Vulnerability
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Possible null pointer dereference in org.owasp.dependencycheck.dependency.Vulnerability.getHighestSeverityText() due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 564 | Medium |
| Class org.owasp.dependencycheck.dependency.Vulnerability defines non-transient non-serializable instance field knownExploitedVulnerability | BAD_PRACTICE | SE_BAD_FIELD | Not available | High |
org.owasp.dependencycheck.dependency.naming.CpeIdentifier
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.owasp.dependencycheck.dependency.naming.CpeIdentifier at new org.owasp.dependencycheck.dependency.naming.CpeIdentifier(String, String, String, Confidence) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 103 | Medium |
org.owasp.dependencycheck.dependency.naming.PurlIdentifier
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.owasp.dependencycheck.dependency.naming.PurlIdentifier at new org.owasp.dependencycheck.dependency.naming.PurlIdentifier(String, String, String, String, Confidence) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 117 | Medium |
| Exception thrown in class org.owasp.dependencycheck.dependency.naming.PurlIdentifier at new org.owasp.dependencycheck.dependency.naming.PurlIdentifier(String, String, String, Confidence) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 99 | Medium |
org.owasp.dependencycheck.reporting.ReportGenerator
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Suppressing annotation OBL_UNSATISFIED_OBLIGATION on the method org.owasp.dependencycheck.reporting.ReportGenerator.processTemplate(String, File) is unnecessary | STYLE | US_USELESS_SUPPRESSION_ON_METHOD | 387-393 | Medium |
org.owasp.dependencycheck.reporting.ReportTool
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Possible null pointer dereference in org.owasp.dependencycheck.reporting.ReportTool.determineScore(Vulnerability) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 123 | Medium |
org.owasp.dependencycheck.reporting.SarifRule
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 200 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 203 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 181 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 178 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 184 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 193 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 187 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 190 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 238 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 241 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 214 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 211 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 232 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 226 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 229 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 217 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 223 | Medium |
| Possible null pointer dereference in new org.owasp.dependencycheck.reporting.SarifRule(String, String, String, String, CvssV2, CvssV3, CvssV4) due to return value of called method | STYLE | NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE | 220 | Medium |
org.owasp.dependencycheck.utils.WriteLock
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.owasp.dependencycheck.utils.WriteLock at new org.owasp.dependencycheck.utils.WriteLock(Settings, boolean) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 112 | Medium |
| Exception thrown in class org.owasp.dependencycheck.utils.WriteLock at new org.owasp.dependencycheck.utils.WriteLock(Settings, boolean, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 134 | Medium |
org.owasp.dependencycheck.xml.assembly.GrokParser
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Suppressing annotation OBL_UNSATISFIED_OBLIGATION on the method org.owasp.dependencycheck.xml.assembly.GrokParser.parse(File) is unnecessary | STYLE | US_USELESS_SUPPRESSION_ON_METHOD | 68-72 | Medium |
org.owasp.dependencycheck.xml.hints.HintParser
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Suppressing annotation OBL_UNSATISFIED_OBLIGATION on the method org.owasp.dependencycheck.xml.hints.HintParser.parseHints(File) is unnecessary | STYLE | US_USELESS_SUPPRESSION_ON_METHOD | 115-121 | Medium |
org.owasp.dependencycheck.xml.pom.PomProjectInputStream
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Exception thrown in class org.owasp.dependencycheck.xml.pom.PomProjectInputStream at new org.owasp.dependencycheck.xml.pom.PomProjectInputStream(InputStream) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. | BAD_PRACTICE | CT_CONSTRUCTOR_THROW | 54 | Medium |
org.owasp.dependencycheck.xml.suppression.SuppressionParser
| Bug | Category | Details | Line | Priority |
|---|---|---|---|---|
| Suppressing annotation OBL_UNSATISFIED_OBLIGATION on the method org.owasp.dependencycheck.xml.suppression.SuppressionParser.parseSuppressionRules(File) is unnecessary | STYLE | US_USELESS_SUPPRESSION_ON_METHOD | 90-94 | Medium |