␡
- Rules
- Risk Assessment Summary
- IDS00-J. Sanitize untrusted data passed across a trust boundary
- IDS01-J. Normalize strings before validating them
- IDS02-J. Canonicalize path names before validating them
- IDS03-J. Do not log unsanitized user input
- IDS04-J. Limit the size of files passed to ZipInputStream
- IDS05-J. Use a subset of ASCII for file and path names
- IDS06-J. Exclude user input from format strings
- IDS07-J. Do not pass untrusted, unsanitized data to the Runtime.exec() method
- IDS08-J. Sanitize untrusted data passed to a regex
- IDS09-J. Do not use locale-dependent methods on locale-dependent data without specifying the appropriate locale
- IDS10-J. Do not split characters between two data structures
- IDS11-J. Eliminate noncharacter code points before validation
- IDS12-J. Perform lossless conversion of String data between differing character encodings
- IDS13-J. Use compatible encodings on both sides of file or network I/O
This chapter is from the book
Risk Assessment Summary
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
IDS00-J |
high |
probable |
medium |
P12 |
L1 |
IDS01-J |
high |
probable |
medium |
P12 |
L1 |
IDS02-J |
medium |
unlikely |
medium |
P4 |
L3 |
IDS03-J |
medium |
probable |
medium |
P8 |
L2 |
IDS04-J |
low |
probable |
high |
P2 |
L3 |
IDS05-J |
medium |
unlikely |
medium |
P4 |
L3 |
IDS06-J |
medium |
unlikely |
medium |
P4 |
L3 |
IDS07-J |
high |
probable |
medium |
P12 |
L1 |
IDS08-J |
medium |
unlikely |
medium |
P4 |
L3 |
IDS09-J |
medium |
probable |
medium |
P8 |
L2 |
IDS10-J |
low |
unlikely |
medium |
P2 |
L3 |
IDS11-J |
high |
probable |
medium |
P12 |
L1 |
IDS12-J |
low |
probable |
medium |
P4 |
L3 |
IDS13-J |
low |
unlikely |
medium |
P2 |
L3 |