Miscellaneous (MSC)
Rules
- MSC00-J. Use SSLSocket rather than Socket for secure data exchange
- MSC01-J. Do not use an empty infinite loop
- MSC02-J. Generate strong random numbers
- MSC03-J. Never hard code sensitive information
- MSC04-J. Do not leak memory
- MSC05-J. Do not exhaust heap space
- MSC06-J. Do not modify the underlying collection when an iteration is in progress
- MSC07-J. Prevent multiple instantiations of singleton objects
- MSC08-J. Do not store nonserializable objects as attributes in an HTTP session
- MSC09-J. For OAuth, ensure (a) [relying party receiving user's ID in last step] is same as (b) [relying party the access token was granted to].
- MSC10-J. Do not use OAuth 2.0 implicit grant (unmodified) for authentication
- MSC11-J. Do not let session information leak within a servlet
Risk Assessment Summary
| Rule | Severity | Likelihood | Detectable | Repairable | Priority | Level |
|---|---|---|---|---|---|---|
| MSC00-J | Medium | Likely | No | No | P6 | L2 |
| MSC01-J | Low | Unlikely | Yes | Yes | P3 | L3 |
| MSC02-J | High | Probable | No | No | P6 | L2 |
| MSC03-J | High | Probable | No | No | P6 | L2 |
| MSC04-J | Low | Unlikely | No | No | P1 | L3 |
| MSC05-J | Low | Probable | No | No | P2 | L3 |
| MSC06-J | Low | Probable | No | No | P2 | L3 |
| MSC07-J | Low | Unlikely | Yes | No | P2 | L3 |
